WO2020114336A1 - 信息同步方法、认证方法及装置 - Google Patents

信息同步方法、认证方法及装置 Download PDF

Info

Publication number
WO2020114336A1
WO2020114336A1 PCT/CN2019/122252 CN2019122252W WO2020114336A1 WO 2020114336 A1 WO2020114336 A1 WO 2020114336A1 CN 2019122252 W CN2019122252 W CN 2019122252W WO 2020114336 A1 WO2020114336 A1 WO 2020114336A1
Authority
WO
WIPO (PCT)
Prior art keywords
security group
terminal
association information
node
updated
Prior art date
Application number
PCT/CN2019/122252
Other languages
English (en)
French (fr)
Inventor
黄忠金
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19893018.2A priority Critical patent/EP3817272A4/en
Publication of WO2020114336A1 publication Critical patent/WO2020114336A1/zh
Priority to US17/160,551 priority patent/US20210185039A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/255—Maintenance or indexing of mapping tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of network technology, in particular to an information synchronization method, authentication method and device.
  • each node device can be divided into at least an authentication node and an execution node according to their different functions.
  • the authentication node authenticates the terminal to determine the security group to which the terminal belongs; when the terminal sends a message, the execution node determines that the security group to which the terminal belongs matches the security group policy, and processes the report according to the security group policy Text.
  • the security group determined by the authentication node needs to be synchronized to the execution node.
  • inline security group tag (English: inline security group tag, referred to as inline SGT) technology is generally used to synchronize the security group determined by the authentication node to the execution node. Specifically, when the authentication node passes the authentication of the terminal, the security group to which the terminal belongs is stored; when the authentication node receives a message from the terminal, the authentication node generates a security group label according to the security group to which the terminal belongs.
  • inline SGT inline security group tag
  • the label is used to identify the security group to which the terminal belongs; the authentication node will insert the security group label in the header of the message, so that the message will carry the security group label by expanding the message; the authentication node will carry the security group label
  • the message is sent to the execution node; when the execution node receives the message carrying the security group label, it will parse the security group label to determine the security group to which the terminal belongs, and process the message according to the security group policy.
  • the terminal's message needs to be privately extended, and many node devices do not support the private extension of the message, resulting in the inability to implement this method for information synchronization, which shows that the method has poor compatibility , The scope of application is narrow.
  • the embodiments of the present application provide an information synchronization method, an authentication method and a device, which can solve the technical problem of poor compatibility in the related art.
  • the technical solution is as follows:
  • an information synchronization method includes:
  • the method provided in this embodiment can at least achieve the following effects: the synchronization node can synchronize the security group association information from the authentication node to the execution node, so that the execution node can obtain the security group association information of the terminal, and the execution node associates according to the security group Information, you can perceive the security group that the terminal belongs to, so that you can process the terminal's messages according to the security group policy, you can achieve the separation of the authentication node and the execution node, breaking the constraints on the network, expanding the scope of application, improving Compatibility.
  • the determining includes at least one execution node of the target execution node, including:
  • the effect achieved may include at least: when the synchronization node receives the security group information of the terminals in different network segments, each security group information may be sent to the execution node of the corresponding network segment, and each The function of the execution node receiving the security group information of the terminal on the local network segment achieves the effect of refined push, which can avoid the execution node consuming operating resources due to frequent reception of security group information.
  • the storage resources of the execution node can be saved, and the amount of data of the security group associated information to be stored by a single execution node is too large.
  • the amount of data of the security group information to be synchronized by the synchronization node is huge, and by finely transmitting the security group information, the operating efficiency of the entire system can be improved.
  • the determining includes at least one execution node of the target execution node, including:
  • the method before determining the target execution node corresponding to the target network segment from the correspondence between the network segment and the execution node according to the target network segment to which the network address belongs, the method further includes :
  • Receiving a configuration instruction which is used to indicate the correspondence between the network segment and the execution node.
  • the effect achieved can include at least: the function of supporting the security group subscription configuration to meet the user's custom requirements.
  • the receiving security group association information of the terminal sent by the authentication node includes:
  • first security group association information of a first terminal sent by a first authentication node where the first security group association information is used to indicate between the network address of the first terminal and the first security group to which the first terminal belongs Mapping relationship between
  • Second security group association information of a second terminal sent by a second authentication node where the second authentication node is different from the first authentication node, and the second security group association information is used to indicate the second terminal's Mapping relationship between the network address and the second security group to which the second terminal belongs;
  • the determining includes at least one execution node of the target execution node, including:
  • At least one execution node including a first target execution node is determined, and the first target execution node is configured to process a message transmitted between the first terminal and the second terminal according to a security group policy.
  • the receiving the security group association information of the terminal sent by the authentication node includes:
  • the determining includes at least one execution node of the target execution node, including:
  • At least one execution node including a second target execution node is determined, and the second target execution node is configured to process the message transmitted between the third terminal and the network resource according to a security group policy.
  • the receiving security group association information of the terminal sent by the authentication node includes:
  • the receiving security group association information of the terminal sent by the authorized device includes:
  • the first authorization device is an authorization device that supports a target function
  • the target function is a function of sending security group association information to a synchronization node.
  • the security group association information of the terminal is sent from the authorized device to the authentication point device, including:
  • the security group information of the terminal is sent to the authentication point device by a second authorized device, and the second authorized device is an authorized device that does not support the target function.
  • the method further includes:
  • the updated security group association information is used to indicate the mapping relationship between the updated network address of the terminal and the security group, or the updated security group association information is used to indicate the The mapping relationship between the terminal's network address and the updated security group to which the terminal belongs, or the updated security group association information is used to indicate the updated network address of the terminal and the terminal to which the terminal belongs The mapping relationship between the updated security groups.
  • the effect achieved may include at least: if the current location of the terminal changes, the network address or security group of the terminal may be updated, so that the authentication node can update the security group with the update of the current location of the terminal Association information, and report the updated security group association information to the synchronization node, so that the synchronization node can obtain the updated security group association information of the terminal, and ensure the accuracy of the terminal security group association information stored by the synchronization node.
  • the method before sending the security group association information to the target execution node, the method further includes:
  • the sending of the security group association information to the target execution node includes:
  • the structured data format is a protocol buffer protocol buffer format
  • the method before sending the security group association information to the target execution node, the method further includes:
  • the sending of the security group association information to the target execution node includes:
  • the receiving the security group association information of the terminal sent by the authentication node includes:
  • the method also includes:
  • the receiving the security group association information of the terminal sent by the authentication node includes:
  • the method also includes:
  • the receiving security group association information of the authentication node includes:
  • the first network connection belongs to at least one of a long connection and an encrypted channel.
  • the method before receiving the security group association information of the authentication node, the method further includes:
  • the effect achieved by the process of establishing the first network connection through the above method may include at least: the first network connection may be a bidirectional connection, that is, when data is transmitted between any authentication node and the synchronization node, the authentication node and the synchronization node are the same as the client Only one network connection can be configured for the server and server modes, which greatly reduces the workload of configuration operations, and reduces the workload of later operation and maintenance brought by maintaining the network connection. In particular, in scenarios where there are a large number of authentication nodes, it is only necessary to configure the connection between the authentication node and the synchronization node, and the connection configuration of the mesh topology (English: full-mesh) will not be formed, which reduces the deployment and maintenance workload .
  • the connection configuration of the mesh topology English: full-mesh
  • the sending the security group association information to the target execution node includes:
  • the security group association information is sent to the target execution node through a second network connection, and the second network connection belongs to at least one of a long connection and an encrypted channel.
  • the method before receiving the security group association information of the authentication node, the method further includes:
  • the effect achieved may include at least: the second network connection may be a bidirectional connection, that is, when data is transmitted between the synchronization node and any execution node, the synchronization node and the authentication node pass the client and
  • the server mode only needs to configure a network connection, which greatly reduces the workload of configuration operations, and reduces the workload of later operation and maintenance brought by the maintenance of network connections.
  • the connection configuration of the mesh topology English: full-mesh
  • the method further includes:
  • the updated first security group association information is used to indicate the mapping relationship between the updated network address of the first terminal and the first security group, or the updated first security The group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs, or the updated first security group association information is used to Indicating a mapping relationship between the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the method further includes:
  • the updated second security group association information is used to indicate a mapping relationship between the updated network address of the second terminal and the second security group, or the updated second security
  • the group association information is used to indicate the mapping relationship between the network address of the second terminal and the updated second security group to which the second terminal belongs, or the updated second security group association information is used to Indicating a mapping relationship between the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • a packet processing method includes:
  • the synchronization node is used to synchronize the security group association information from an authentication node to an execution node, and the security group association information is used to indicate the terminal's network address and location The mapping relationship between the security groups to which the terminal belongs;
  • the execution node can obtain the security group association information of the terminal by synchronizing the security group association information delivered by the node, so as to be able to perceive the security group to which the terminal belongs, when the terminal traffic arrives
  • the executing node can process the message of the terminal according to the security group policy, which realizes the separation of the authentication node and the executing node, breaks the restriction on the networking, expands the scope of application, and improves the compatibility.
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the synchronization node is used to synchronize the first security group association information from the first authentication node to the execution node, the first A security group association information is used to indicate the mapping relationship between the network address of the first terminal and the first security group to which the first terminal belongs;
  • the synchronization node is used to synchronize the second security group association information from the second authentication node to the execution node, the first The second authentication node is different from the first authentication node, and the second security group association information is used to indicate a mapping relationship between the network address of the second terminal and the second security group to which the second terminal belongs;
  • the receiving of the message of the terminal includes:
  • the processing the message according to the security group policy matched by the security group includes:
  • the message is processed according to a security group policy that matches the first security group and matches the second security group.
  • the obtaining the security group corresponding to the network address from the security group association information according to the network address carried in the message includes:
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the receiving the message of the terminal includes:
  • processing of the message according to the security group policy matched by the security group includes:
  • the message is processed according to a security group policy that matches the third security group and matches the fourth security group to which the network resource belongs.
  • the method further includes:
  • the updated security group association information is used to indicate the mapping relationship between the updated network address of the terminal and the security group, or the updated security group association information is used to indicate the The mapping relationship between the terminal's network address and the updated security group to which the terminal belongs, or the updated security group association information is used to indicate the updated network address of the terminal and the terminal to which the terminal belongs The mapping relationship between the updated security groups.
  • the method before receiving the security group association information of the terminal sent by the synchronization node, the method further includes:
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the method also includes:
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the method also includes:
  • the method further includes:
  • the updated first security group association information is used to indicate the mapping relationship between the updated network address of the first terminal and the first security group, or the updated first security The group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs, or the updated first security group association information is used to Indicating a mapping relationship between the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the method further includes:
  • the updated second security group association information is used to indicate a mapping relationship between the updated network address of the second terminal and the second security group, or the updated second security
  • the group association information is used to indicate the mapping relationship between the network address of the second terminal and the updated second security group to which the second terminal belongs, or the updated second security group association information is used to Indicating a mapping relationship between the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • an authentication method includes:
  • the method provided in this embodiment can at least achieve the following effects: the authentication node obtains the security group association information of the terminal according to the terminal's network address and security group, and sends the security group association information to the synchronization node, which enables the synchronization node to transfer the terminal
  • the security group association information is synchronized to the execution node, so that the execution node can get the terminal's security group association information, then the execution node can perceive the security group to which the terminal belongs according to the security group association information, so that the terminal can follow the security group policy
  • Packet processing can achieve the separation of the authentication node and the execution node, breaking the constraints on networking, expanding the scope of application and improving compatibility.
  • the sending the security group association information to the synchronization node includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the method is applied to at least one of an authorized device and an authentication point device.
  • the authorization device is an authentication and authorization payment AAA server
  • the method is applied to a second authorized device, the second authorized device is an authorized device that does not support a target function, and the target function is a function of sending security group association information to a synchronization node.
  • the method is applied to a first authorized device, and the first authorized device is an authorized device that supports a target function.
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the method also includes:
  • the receiving security group association information of the terminal sent by the synchronization node includes:
  • the method also includes:
  • the method before sending the security group association information to the synchronization node, the method further includes:
  • the first network connection belongs to at least one of a long connection, an encrypted channel, and connection multiplexing;
  • the sending of the security group association information to the synchronization node includes:
  • an information synchronization device is provided, and the device is used to perform the above information synchronization method.
  • the information synchronization device includes a functional module for performing the information synchronization method described in the first aspect or any optional manner of the first aspect.
  • the message processing apparatus includes a functional module for executing the message processing method described in the second aspect or any optional manner of the second aspect.
  • an authentication device is provided, and the device is used to perform the above authentication method.
  • the authentication device includes a function module for performing the authentication method described in the third aspect or any optional manner of the third aspect.
  • a computer device includes a processor and a memory, and the memory stores at least one instruction.
  • the instruction is loaded and executed by the processor to implement the first aspect or the first aspect.
  • a computer device includes a processor and a memory, and at least one instruction is stored in the memory, and the instruction is loaded and executed by the processor to implement the second aspect or the second aspect The operations performed by the message processing method described in any optional aspect of the aspect.
  • a computer device in a ninth aspect, includes a processor and a memory, and the memory stores at least one instruction.
  • the instruction is loaded and executed by the processor to implement the third aspect or the third aspect. The operation performed by the authentication method described in any optional aspect of the aspect.
  • a computer-readable storage medium in which at least one instruction is stored, and the instruction is loaded and executed by the processor to implement the first aspect or any one of the first aspect Select the operation performed by the information synchronization method described in the above method.
  • a computer-readable storage medium in which at least one instruction is stored, and the instruction is loaded and executed by the processor to implement the second aspect or any one of the second aspect The operations performed by the message processing method described in the optional manner.
  • a computer-readable storage medium in which at least one instruction is stored, and the instruction is loaded and executed by the processor to implement the third aspect or any one of the third aspect An operation performed by the authentication method described in the optional manner.
  • a computer program product containing instructions which, when run on a computer device, enable the computer device to implement the information described in the first aspect or any one of the optional aspects of the first aspect The operation performed by the synchronization method.
  • a fourteenth aspect there is provided a computer program product containing instructions which, when run on a computer device, enables the computer device to implement the report described in the second aspect or any one of the optional aspects of the second aspect The operation performed by the text processing method.
  • a computer program product containing instructions which, when run on a computer device, enables the computer device to implement the authentication described in the third aspect or any optional manner of the third aspect The operation performed by the method.
  • a computer equipment cluster including at least one computer equipment, each computer equipment including a processor and a memory, and the processor of the at least one computer equipment is used to execute to implement the first aspect or the first aspect Operations performed by the information synchronization method described in any one of the optional modes.
  • a computer equipment cluster including at least one computer equipment, each computer equipment including a processor and a memory, and the processor of the at least one computer equipment is configured to execute to implement the second aspect or the second aspect Operations performed by the message processing method described in any one of the optional modes.
  • a computer equipment cluster including at least one computer equipment, each computer equipment including a processor and a memory, and the processor of the at least one computer equipment is used to execute to implement the third aspect or the third aspect The operation performed by the authentication method described in any one of the optional modes.
  • a service processing system includes: the information synchronization apparatus according to the fourth aspect, the message processing apparatus according to the fifth aspect, and the sixth aspect The authentication device.
  • the system includes the computer device according to the seventh aspect, the computer device according to the eighth aspect, and the computer device according to the ninth aspect.
  • the system includes the computer device according to the sixteenth aspect, the computer device according to the seventeenth aspect, and the computer device according to the eighteenth aspect.
  • a chip includes a processor and/or program instructions, and when the chip is running, the information described in the first aspect or any optional manner of the first aspect is implemented The operation performed by the synchronization method.
  • a chip in a twenty-first aspect, includes a processor and/or program instructions, and when the chip is running, the above-mentioned second aspect or any one of the optional manners of the second aspect is implemented The operation performed by the message processing method.
  • a chip in a twenty-second aspect, includes a processor and/or program instructions, and when the chip is running, the above-mentioned third aspect or any one of the optional manners of the third aspect is implemented The operation performed by the authentication method.
  • FIG. 1 is an architectural diagram of an implementation environment provided by an embodiment of the present application
  • FIG. 2 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • FIG. 3 is an architectural diagram of another implementation environment provided by embodiments of the present application.
  • FIG. 5 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • FIG. 7 is a system architecture diagram of a computer device cluster provided by an embodiment of the present application.
  • FIG. 8 is a system architecture diagram of another computer device cluster provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of an information synchronization method provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of an information synchronization method provided by an embodiment of the present application.
  • FIG. 13 is a flowchart of a service processing method provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of an information synchronization method provided by an embodiment of the present application.
  • 15 is a flowchart of a packet processing method provided by an embodiment of the present application.
  • 16 is a flowchart of a service processing method provided by an embodiment of the present application.
  • 17 is a schematic diagram of an information synchronization method provided by an embodiment of the present application.
  • 21 is a flowchart of a service processing method provided by an embodiment of the present application.
  • 22 is a schematic structural diagram of an information synchronization device provided by an embodiment of the present application.
  • FIG. 23 is a schematic structural diagram of a packet processing device according to an embodiment of the present application.
  • 24 is a schematic structural diagram of an authentication device provided by an embodiment of the present application.
  • Security group refers to one or more terminals and/or one or more network resources described or organized in groups. Expressed in mathematical form, any security group may include n terminals; or, any security group may include m network resources; or, any security group may include n terminals and m network resources. Among them, n and m are positive integers. Security groups can correspond to security group policies, messages sent by terminals and/or network resources in security groups, messages received by terminals in security groups and/or network resources, terminals and/or network resources in different security groups Messages transmitted between each other can be processed according to the security group policy corresponding to the security group.
  • Terminal Also known as user terminal or user equipment (User Equipment, abbreviation: UE).
  • the terminal may include a mobile phone, a tablet computer, a personal computer, a notebook computer, a telephone, and the like.
  • the terminal may be a mobile terminal.
  • the location of the mobile terminal may change, and as the location of the mobile terminal changes, the network address of the mobile terminal may change.
  • Mobile terminals may include mobile phones, tablet computers, or laptop computers.
  • Network resources can include computing resources, storage resources, network environment resources, databases, network security resources, application service resources, Internet of Things resources, machine learning resources, software development resources, etc.
  • computing resources may include servers, mirroring services, container instances, etc.
  • storage resources may include object storage services, hard disks, and so on.
  • the network address of the network resource can be fixed, and accordingly, the network resource can be called a static resource.
  • Network resources can be local resources or cloud resources.
  • the cloud resources can be resources provided by cloud computing services.
  • the cloud resources can be elastic cloud servers, virtual private clouds (English: Virtual Private), object storage services (English: Object-Based Storage System, abbreviation: OBS), distribution Cache service, cloud database, application performance management (English: Application Performance Management, abbreviation: APM), blockchain service (English: Blockchain Service), machine learning (English: Machine Learning, abbreviation: ML) service, distributed messaging Services, image recognition services, natural language processing (English: natural language processing, abbreviation: NLP) services, etc.
  • Security Group Policy Used to process the terminal's messages, thereby controlling the terminal's access rights or the quality of service provided to the terminal.
  • the security group policy may include at least one of an access permission control policy and an experience guarantee policy.
  • Access rights control strategy used to control the access of terminals and/or network resources in any security group to terminals and/or network resources in other security groups. For example, it can be used to control the behavior of the terminal a in the security group 1 accessing the terminal 2 in the security group b.
  • the access right control policy may include at least one of an allowed access policy and a prohibited access policy.
  • Allow access policy It is used to allow terminals and/or network resources in any security group to access terminals and/or network resources in other security groups.
  • the execution node processes the message according to the access permission policy, the execution node forwards the message to the accessed device, so that the access device can send the message to the accessed device, and the function of allowing the access device to access the accessed device is realized. For example, suppose that terminal a in security group 1 wants to access terminal b in security group 2, when the execution node receives a message sent from terminal a to terminal b, if it matches the security group policies of security group 1 to security group 2 , Matching the access permission policy, it will forward the message of terminal a to terminal b.
  • Prohibited access policy used to prohibit terminals and/or network resources in any security group from accessing terminals and/or network resources in other security groups.
  • the execution node processes the message according to the access prohibition policy, the execution node discards the message so that the access device cannot send the message to the accessed device, and the function of prohibiting the access device from accessing the accessed device is realized. For example, suppose that terminal a in security group 1 wants to access terminal b in security group 2, when the execution node receives a message sent from terminal a to terminal b, if it matches the security group policies of security group 1 to security group 2 , Matching the access prohibition policy, the packet of terminal a will be discarded.
  • the experience assurance strategy used to control the quality of service provided to terminals.
  • the experience assurance strategy may include at least one of a speed limit strategy, a priority scheduling strategy, and a gateway priority access strategy.
  • Rate limiting strategy used to control the size of terminal traffic.
  • the rate limit policy may include a threshold of the terminal's bandwidth, and the bandwidth of the terminal may be controlled within a range that does not exceed the bandwidth threshold to avoid network congestion.
  • Priority scheduling strategy used to control the priority of forwarding the packets of the terminal.
  • the priority scheduling strategy includes the forwarding priority corresponding to the terminal, and the execution node may forward the message of the terminal according to the forwarding priority. For example, suppose that terminal a in security group 1 wants to access terminal b in security group 2, when the execution node receives a message sent from terminal a to terminal b, if it matches the security group policies of security group 1 to security group 2 , Matching the high-priority priority scheduling strategy, the packet of terminal a will be forwarded first.
  • Gateway priority access strategy used to control the priority of terminal access to the gateway.
  • the gateway priority access strategy may include the priority of the terminal accessing the gateway. If the access gateway of a certain terminal has a higher priority, the execution node may preferentially access the terminal to the gateway.
  • Authentication node used to authenticate the terminal and determine the security group to which the terminal belongs.
  • the authentication node may include at least one of an authentication point device and an authorized device. The authorized device and the authentication point device can communicate and complete the authentication process through interaction.
  • Authentication point device used to respond to the authentication request of the terminal, send the authentication request to the authorized device, receive the authentication result of the authorized device, and determine whether to allow the terminal to access the network according to the authentication result.
  • the physical entity of the authentication point device may include network devices such as wireless access points (WirelessAccessPoint, abbreviation: AP), firewalls, routers, and switches.
  • the authentication point device may be an access layer switch.
  • the authentication point device can be deployed locally or in the cloud.
  • the authentication point device can provide virtualized resources for cloud computing services.
  • the authentication point device can maintain communication with the authorized device through a network protocol.
  • an authentication point device can communicate with an authorized device through a remote user dialing authentication system (Remote Authentication Dial In User Service, abbreviation: Radius) protocol.
  • Remote user dialing authentication system Remote Authentication Dial In User Service
  • the processing logic of the authentication point device can be encapsulated as a client of any software with an authentication function, and the client can be installed on one or more network devices at the access layer to After making the client run by one or more network devices, it becomes an authentication point device.
  • Authorized device used to receive the authentication request of the authentication point device, authenticate the terminal according to the authentication request, and send the authentication result to the authentication point device.
  • the authorized device may determine the security group to which the terminal belongs during the authentication process or after the authentication is passed.
  • the authorized device may be a controller node in the network, which may be the core of authentication, authorization, and business policy management in the network, and may interact with the authentication point device to complete the terminal authentication and policy distribution function authorization device It can maintain communication with the authentication point device through the network protocol.
  • an authorized device can communicate with an authenticated device through the Radius protocol.
  • the authorization device may be a server.
  • the authorization device may be an authentication authorization accounting (AAA or 3A) server, and the authorization device may be deployed in a data center of the campus network.
  • the authorization device may be implemented by software, for example, the processing logic of the authorization device may be a software package, and the software package may be installed on one or more physical servers to enable one or more physical servers to run the software package Realize the function of authorized equipment.
  • Execution node It can also be called an execution point device or a policy execution point device.
  • the execution node is used to process the messages of the terminal according to the security group policy.
  • the physical entities of the execution node may include switches, firewalls, routers, wireless controllers (Wireless Access Point Controller, abbreviation: AC), and so on.
  • the processing logic of the execution node may be packaged as a client of any software with security group policy execution function, and the client may be installed on one or more network devices at the aggregation layer or the core layer, so that the one or After running the client, multiple network devices become execution nodes.
  • the execution node may be located locally or in the cloud.
  • the execution node may provide a virtualized resource for cloud computing services.
  • Synchronization node used to synchronize the security group association information of the terminal to at least one execution node.
  • both the authentication node and the execution node can store the security group association information of the terminal, so that on the network forwarding plane, the execution node can also hold the authorized security group information of the terminal, so that the execution node
  • the packet matches the corresponding security group policy and then processes the packet according to the security group policy.
  • the synchronization node may be implemented by software, for example, the synchronization node may be implemented by one or more of mirror, application, service, microservice, module, submodule, class or function;
  • the processing logic of the synchronization node may be packaged as a software package, and when any one or more devices run the software package, it may serve as a synchronization node to implement the function of the synchronization node.
  • the software package may be installed on a server cluster, and when the server cluster runs the software package, the server cluster may serve as a synchronization node.
  • the cluster installation is just an example.
  • the software package can be installed on a single server.
  • the server When the server runs the software package, the server can be used as a synchronization node.
  • the synchronization node can also be implemented by hardware.
  • the processing logic of the synchronization node can be packaged on one or more chips.
  • the chip can be a single chip microcomputer, a programmable logic device or other processors.
  • the physical entities of the synchronization node may include servers, personal computers, firewalls, routers, switches, etc.
  • the synchronization node can be deployed locally or in the cloud.
  • the synchronization node may be deployed in the data center of the campus network.
  • the geographic location of the synchronization node is not limited.
  • the synchronization node may be independently deployed.
  • the synchronization node may be one or more dedicated physical entities, and the physical entity does not need to provide functions of other node devices than the synchronization node.
  • the synchronization node can also be deployed together with other node devices.
  • one or more physical entities can be enabled to provide the functions of the synchronization node and other node devices other than the synchronization node.
  • This embodiment does not limit the deployment method of the synchronization node.
  • the synchronization node may be provided as a stand-alone, cluster, distributed system, or master-slave system, and the application mode of the synchronization node is not limited in this application.
  • FIG. 1 is an architectural diagram of an implementation environment provided by an embodiment of the present application.
  • the implementation environment includes: a terminal, an authentication node, a synchronization node, and an execution node.
  • Different devices in the implementation environment may be connected through a network, where the authentication node may It is used to execute the authentication method in the following embodiments; the synchronization node can be used to execute the information synchronization method in the following embodiments; the execution node can be used to execute the message processing method in the following embodiments; the terminal, The authentication node, the synchronization node, and the execution node can interact to perform the service processing method in the following embodiments.
  • FIG. 2 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • the implementation environment includes: a terminal, an authentication point device, a synchronization node, an authorization device, and an execution node.
  • the authentication point device and the authorization device can interactively perform the authentication method in the following embodiments; the terminal, the authentication point device, the synchronization node, the authorization device, and the execution node can interact to perform the business processing in the following embodiments method.
  • FIG. 3 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • the implementation environment includes: a first terminal, a second terminal, a first authentication node, a second authentication node, and a synchronization node , Execution node.
  • the first terminal and the first authentication node are connected through the network
  • the second terminal and the second authentication node are connected through the network
  • both the first authentication node and the second authentication node may be connected through the network and the synchronization node.
  • the first terminal, the second terminal, the first authentication node, the second authentication node, the synchronization node, and the execution node can interactively execute the information synchronization method in the following embodiments.
  • the following embodiments of FIGS. 14 to 16 can be applied to the implementation environment shown in FIG. 3.
  • FIG. 4 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • the implementation environment includes : First terminal, second terminal, first authentication point device, second authentication point device, synchronization node, execution node, and authorization device.
  • FIG. 5 is an architectural diagram of another implementation environment provided by an embodiment of the present application.
  • the implementation environment includes: a terminal, an authentication node, a synchronization node, an execution node, and network resources.
  • the terminal in the implementation environment of FIG. 5 may be referred to as a third terminal
  • the authentication node in the implementation environment of FIG. 5 may It is divided into a third authentication node and a fourth authentication node.
  • the computer device 600 may be provided as at least one of a synchronization node, an execution node, and an authentication node in the following method embodiments.
  • the computer device 600 may have a relatively large difference due to different configurations or performances, and may include one or more processors (English: central processing units, abbreviation: CPU) 601 and one or more memories 602, where the memory At least one instruction is stored in 602, and the at least one instruction is loaded and executed by the processor 601 to implement at least one of the information synchronization method, the message processing method, and the authentication method provided by the following method embodiments.
  • the computer device may also have components such as a wired or wireless network interface and an input-output interface for input and output.
  • the computer device may also include other components for implementing device functions, which will not be repeated here.
  • the computer device 600 may be a computer device in a cloud environment, or a computer device in an edge environment, or a computer device in a terminal environment, which is not limited.
  • the operating system running on the computer device 600 may be a Linux operating system, of course, it may also be another operating system, such as a Windows operating system, etc., which is not limited in this embodiment.
  • the computer device cluster may be provided as at least one of a synchronization node, an execution node, and an authentication node in the following method embodiments.
  • the computer device cluster includes at least one computer device 700, and each computer device 700 can perform any of at least one of the information synchronization method, the message processing method, and the authentication method provided in the following method embodiments.
  • One step or any number of steps, different steps may be executed by different computer devices 700.
  • the structure of each computer device 700 is the same as the structure of the computer device 600 in the embodiment of FIG. 6.
  • each computer device 700 may have a relatively large difference due to different configurations or performance, and may include one or more processors 701 and one or more memories 702, where at least one item is stored in the memory 702 Instructions, the at least one instruction is loaded and executed by the processor 701 to implement any one or more steps in at least one of the information synchronization method, the message processing method, and the authentication method provided in the following method embodiments.
  • Each computer device 700 may be a computer device in a cloud environment, or a computer device in an edge environment, or a computer device in a terminal environment, which is not limited.
  • the computer device cluster may be provided as at least one of a synchronization node, an execution node, and an authentication node in the following method embodiments.
  • the computer equipment cluster includes a cloud computing system and at least one computer equipment 800.
  • the cloud computing system can execute any one or more steps of the information synchronization method, message processing method, and authentication method provided in the following method embodiments, and each computer device 800 can also execute the following method embodiments Any one or more steps in at least one of the provided information synchronization method, message processing method, and authentication method.
  • the cloud computing system in FIG. 8 can be implemented through a server cluster in the cloud.
  • the cloud computing system can extend the computing power of computing through virtualization technology to achieve the sharing of software and hardware resources and information, which is provided to each cloud computing system on demand. Node equipment, so that each node equipment to maximize its effectiveness.
  • each computer device 800 is the same as the structure of the computer device 600 in the embodiment of FIG. 6.
  • Each computer device 800 may be a computer device in a cloud environment, or a computer device in an edge environment, or a computer device in a terminal environment, which is not limited.
  • a computer-readable storage medium is also provided, for example, a memory including instructions that can be loaded and executed by a processor of a synchronization node to complete the information synchronization method in the following embodiments.
  • the computer-readable storage medium may be Read-Only Memory (ROM), Random Access Memory (RAM), Compact Disc Read-Only Memory (CD) -ROM), magnetic tape, floppy disk and optical data storage devices, etc.
  • a computer-readable storage medium is also provided, for example, a memory including instructions that can be loaded and executed by a processor of an execution node to complete the message processing method in the following embodiments.
  • the computer-readable storage medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, or the like.
  • a computer-readable storage medium such as a memory including instructions that can be loaded and executed by a processor of an authentication node to complete the authentication method in the following embodiments.
  • the computer-readable storage medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, or the like.
  • FIG. 9 is a flowchart of an authentication method provided by an embodiment of the present application.
  • the execution subject of the method may be an authentication node, including the following steps:
  • the authentication node receives the authentication request of the terminal.
  • the terminal When the terminal accesses the network, the terminal can generate an authentication request.
  • the authentication request is used to authenticate the terminal.
  • the terminal can send the authentication request to the authentication node.
  • the authentication node can receive the authentication request of the terminal to authenticate the terminal according to the authentication request. .
  • the authentication node authenticates the terminal to obtain the security group to which the terminal belongs.
  • the authentication node may obtain the security group to which the terminal belongs from the correspondence between the authentication information and the security group according to the authentication information of the terminal.
  • the authentication information of the terminal may include at least one of user information, location information, and other information.
  • the authentication information of the terminal may be carried in the authentication request, and the authentication node may parse the authentication request to obtain the authentication information carried in the authentication request.
  • the authentication node can also obtain the authentication information of the terminal through other methods.
  • the authentication node can receive the authentication information of the terminal issued by the core network element, or query the authentication information of the terminal from a storage device. The method of obtaining authentication information is not limited.
  • the user information may include at least one of the department to which the user belongs, the role of the user, and the user identification; the location information may be the current location of the terminal.
  • the location information may include at least one of the terminal's access device group, the terminal's current network address range, and the terminal's Service Set Identifier (Service Set Identifier, abbreviation: SSID).
  • the other information may be any information other than user information and location information used for authentication.
  • the other information may include a time period to which the current time point belongs, a terminal device group to which the terminal belongs, customization conditions, and the like.
  • the authentication node may parse the terminal's authentication request, and obtain the terminal's authentication information from the authentication request.
  • the authentication information of the terminal may also be obtained through other methods.
  • the method of authentication information is not limited.
  • the correspondence between the authentication information and the security group may include at least one authentication information and the corresponding at least one security group.
  • the authentication node may receive a configuration instruction, and from the configuration instruction, obtain the correspondence between the authentication information and the security group.
  • the configuration instruction may be triggered by a configuration operation, and the configuration instruction may carry the correspondence between authentication information and security groups.
  • the security group obtained by the authentication node can be represented by the group identifier of the security group, and the group identifier is used to identify the corresponding security group, and can be represented by numbers, letters, character strings, or any other data form.
  • the group identification may be recorded as "Group id (group identification number)".
  • the authentication node obtains the security group association information of the terminal according to the terminal's network address and security group.
  • the network address of the terminal may be an Internet Protocol (Internet Protocol, abbreviation: IP) address of the terminal.
  • IP Internet Protocol
  • the authentication node may obtain the network address of the terminal from the authentication request or other requests of the terminal.
  • the authentication point device can send the terminal's network address to the authorized device.
  • the authentication point device can send the terminal's network address to the authorized device during the authentication process, and
  • the authentication point device may obtain the terminal's network address and send the terminal's network address to the authorized device after passing the terminal authentication.
  • the security group association information is used to indicate the mapping relationship between the terminal's network address and the security group to which the terminal belongs.
  • the security group association information may include the network address of the terminal and the group identification of the security group.
  • the data form of the security group association information may be an entry.
  • the security group association information may be as shown in Table 1 below.
  • the network address of the terminal in Table 1 is "128.107.162.22", and the identifier of the security group is "100".
  • the entry is only an example of the data form of the security group association information, and this embodiment does not limit the specific data form of the security group association information.
  • the network address of the terminal and the group identifier of the security group may be encapsulated to obtain the security group association information.
  • the authentication node can generate a blank entry and write the terminal's network address and security group group ID to the blank entry, then the entry carrying the terminal's network address and security group group ID is Can be used as security group association information.
  • this way of acquiring security group association information is only described by way of example, and this embodiment does not limit the manner of acquiring security group association information.
  • the authorization device may obtain the security group association information of the terminal according to the terminal's network address and security group.
  • the authorized device may send the security group association information to the authentication point device.
  • the authentication node sends the security group association information to the synchronization node.
  • the authentication node may establish a first network connection with the synchronization node, and then may send the security group association information to the synchronization node through the first network connection.
  • the first network connection refers to the network connection between the authentication node and the synchronization node.
  • the first network connection belongs to at least one of encrypted channels, long connections, and connection multiplexing.
  • the authentication node and the synchronization node may use an encryption algorithm to encrypt the transmitted information, thereby improving the security of information transmission.
  • the encryption algorithm may include a symmetric encryption algorithm, an asymmetric encryption algorithm, and the like.
  • the authentication node and the synchronization node can perform bidirectional certificate authentication, that is, the authentication node can authenticate the digital certificate of the synchronization node, and the synchronization node can authenticate the digital certificate of the authentication node.
  • the digital certificate is used to verify the authenticity of the public key.
  • the digital certificate is a file that contains the information of the public key and the owner of the public key.
  • the digital certificate can be generated by a certificate authority (English: Certificate Authority, abbreviated as: CA) center or a customized trusted institution in an enterprise system.
  • the authentication node and the synchronization node may continue to send the security group association information multiple times through the first network connection, thereby saving performance overhead during multiple connections.
  • the first network connection is connection multiplexing
  • multiple requests and/or responses transmitted between the authentication node and the synchronization node can multiplex one connection, thereby reducing the number of connections and improving the efficiency of information transmission.
  • the first network connection may be a network connection established based on the Hypertext Transfer Protocol 2.0 (English: HyperText Transfer Protocol, abbreviation: HTTP2.0) protocol.
  • HTTP2.0 HyperText Transfer Protocol
  • the authentication node and the synchronization node can establish a network connection through any network communication protocol, for example, the authentication node and the synchronization node can use an application.
  • the layer protocol establishes a network connection.
  • the application layer protocol includes but is not limited to the network configuration (netcof) protocol, real-time message transmission (English: Real Time Messaging Protocol, abbreviation: RTMP) protocol, etc.
  • RTMP Real Time Messaging Protocol
  • the authentication node and the synchronization node The network communication protocol between is not limited.
  • the authentication node may be a client of the first network connection, and the synchronization node may be a server of the first network connection.
  • the authentication node may generate a first network connection request and send the first network connection request to the synchronization node, where the first network connection request is used to request to establish a first network connection between the authentication node and the synchronization node; the synchronization node may receive the first When a network connection is requested, a first network connection response is sent to the authentication node, and the first network connection response is used to confirm the establishment of the first network connection.
  • the authentication node may receive the first network connection response of the synchronization node.
  • the authentication node is the client of the first network connection, and the manner in which the synchronization node is the server of the first network connection is only described by way of example, or the authentication node may be the server of the first network connection, and the synchronization node is the first network connection Client, this embodiment does not limit the process of establishing the first network connection.
  • the effect achieved by the process of establishing the first network connection through the above method may include at least: the first network connection may be a bidirectional connection, that is, when data is transmitted between any authentication node and the synchronization node, the authentication node and the synchronization node are the same as the client Only one network connection can be configured for the server and server modes, which greatly reduces the workload of configuration operations and reduces the workload of maintenance and maintenance brought by the maintenance of network connections. In particular, in scenarios where there are a large number of authentication nodes, it is only necessary to configure the connection between the authentication node and the synchronization node, and the connection configuration of the mesh topology (English: full-mesh) will not be formed, which reduces the deployment and maintenance workload .
  • the connection configuration of the mesh topology English: full-mesh
  • the authentication node may encode the security group association information according to the structured data format.
  • the structured data format may be a protocol buffer (English: protocol) format.
  • this step may include: sending the encoded security group association information to the synchronization node, that is, sending the structured security group association information to the synchronization node.
  • the authentication node may send the security group association information in the protocol buffer format to the synchronization node.
  • the authentication node may compress the security group association information.
  • any compression algorithm may be used to compress the security group-related information.
  • the compression algorithm may include a zipper (English: Zip) compression algorithm.
  • this step may include sending the compressed security group association information to the synchronization node.
  • the authentication node may send the security group association information in the Zip format to the synchronization node.
  • the authentication node may send the security group association information of the terminal to the synchronization node in real time. Specifically, the authentication node may send the security group association information of the terminal to the synchronization node whenever the security group association information of any terminal is acquired, so that the security group policy of the terminal takes effect as soon as possible.
  • the security group association information of the terminal may be updated, and accordingly, the authentication node may send the updated security group association information of the terminal to the synchronization node.
  • the case where the security group association information is updated may include at least one of the following cases (1) to (3).
  • Case (1) The network address of the terminal is updated. Accordingly, the method provided in this embodiment may further include the following steps (1.1) to (1.3):
  • Step (1.1) The authentication node obtains the updated network address of the terminal.
  • the terminal may send the updated network address to the authentication node, and the authentication node may receive the updated network address of the terminal to obtain the updated network address.
  • the terminal may send the updated network address to the authentication point device, and the authentication point device may receive the updated network address of the terminal and send the updated network address to the authorized device.
  • the authentication point device can generate a network address update request according to the updated network address of the terminal, and the network address update request carries the updated network address, then the authorized device can receive the network address update request and parse the network address update request To get the updated network address.
  • Step (1.2) The authentication node obtains the updated security group association information of the terminal according to the updated network address and security group.
  • the updated security group association information is used to indicate the mapping relationship between the updated network address and the security group to which the terminal belongs.
  • the updated security group association information may include the updated network address of the terminal and the group identification of the security group.
  • Step (1.3) The authentication node sends the updated security group association information to the synchronization node.
  • the effect achieved can at least include: if the current location of the terminal changes, the network address of the terminal can be updated, and the authentication node can be updated as the network address of the terminal is updated Security group association information, and report the updated security group association information to the synchronization node, so that the synchronization node can obtain the updated security group association information of the terminal, and ensure the accuracy of the terminal security group association information stored by the synchronization node.
  • Case (2) The security group to which the terminal belongs is updated. Accordingly, the method provided in this embodiment may further include the following steps (2.1) to (2.3):
  • Step (2.1) The authentication node obtains the updated security group of the terminal.
  • the authentication node may obtain the updated authentication information of the terminal, and obtain the updated security group to which the terminal belongs from the correspondence between the authentication information and the security group according to the updated authentication information of the terminal.
  • the updated authentication information may include updated location information, updated other information, updated user information, and so on.
  • the updated location information is used to indicate the updated location of the terminal.
  • the updated other information may include the updated time period and the updated terminal group.
  • the updated user information may include the updated department and the updated location. , The updated account, etc.,
  • the updated security group acquisition mode may include any one or more of the following modes 1 to 2.
  • the authentication node can obtain the updated location information of the terminal, and obtain the updated security group to which the terminal belongs from the correspondence between the location information and the security group according to the updated location information.
  • the correspondence between the location information and the security group may include at least one location information and at least one security group identifier, and the correspondence between the location information and the security group may be pre-configured on the authentication node, for example, on the 3A server Pre-configured.
  • the correspondence between location information and security groups can be shown in Table 2 below:
  • Visitor area A2 canteen A3 dorm room A4 meeting room A5
  • the authentication node obtains the security group to which the terminal belongs from the correspondence between the location information and the security group shown in Table 1. It is A1. After the terminal moves from the office area to the visitor area, the authentication node can obtain from the correspondence between the location information and the security group shown in Table 1 that the updated security group to which the terminal belongs is A2.
  • Method 2 The authentication node can obtain the updated time period, and obtain the updated security group to which the terminal belongs from the correspondence between the time period and the security group according to the updated time period.
  • the correspondence between the time period and the security group may include at least one time period and an identifier of at least one security group.
  • the corresponding relationship between the time period and the security group may be pre-configured on the authentication node, for example, pre-configured on the 3A server.
  • the correspondence between the time period and the security group can be shown in Table 3 below:
  • the authentication node when a terminal accesses the network, assuming that a terminal accesses the network at 10:00, the authentication node obtains the terminal from the correspondence between the time period and the security group shown in Table 3 The security group to which it belongs is A2. After the current time reaches 11:30, the authentication node can obtain the updated security group to which the terminal belongs to A3 from the correspondence between the time period and the security group shown in Table 3.
  • Step (2.2) The authentication node obtains the updated security group association information of the terminal according to the terminal's network address and the updated security group to which the terminal belongs.
  • the updated security group association information is used to indicate the mapping relationship between the terminal's network address and the updated security group to which the terminal belongs.
  • the updated security group association information may include the network address of the terminal and the updated security group identifier.
  • Step (2.3) The authentication node sends the updated security group association information of the terminal to the synchronization node.
  • the effect achieved may include at least: if the authentication information of the terminal changes, the security group to which the terminal belongs can be updated, and the authentication node can update with the security group to which the terminal belongs , Update the security group association information, and report the updated security group association information to the synchronization node, so that the synchronization node can obtain the updated terminal security group association information, to ensure the accuracy of the terminal security group association information stored by the synchronization node .
  • the authorized device may send the updated security group to which the terminal belongs to the authentication point device.
  • the authorized device may write the updated security group to which the terminal belongs to any message, and send the message carrying the updated security group to the authentication point device.
  • the message may be an authorization change (English: Change-of-Authorization, abbreviation: CoA) message in the Radius protocol.
  • Case (3) The network address of the terminal and the security group to which the terminal belongs are updated. Accordingly, the method provided in this embodiment may further include the following steps (3.1) to (3.3):
  • Step (3.1) The authentication node obtains the updated network address of the terminal and the updated security group to which the terminal belongs.
  • Step (3.1) is the same as the above step (1.1) and step (2.1), and will not be repeated here.
  • Step (3.2) The authentication node obtains the updated security group association information of the terminal according to the updated network address of the terminal and the updated security group to which the terminal belongs.
  • Step (3.2) is the same as the above step (1.2) and step (2.2), and will not be repeated here.
  • the updated security group association information is used to indicate the mapping relationship between the updated network address of the terminal and the updated security group to which the terminal belongs.
  • the updated security group association information may include the updated network address of the terminal and the updated security group identifier.
  • Step (3.3) The authentication node sends the updated security group association information to the synchronization node.
  • Step (3.3) is the same as the above step (1.3) and will not be repeated here.
  • the authentication node obtains the security group association information of the terminal according to the terminal's network address and security group, and sends the security group association information to the synchronization node, so that the synchronization node can synchronize the terminal's security group association information to
  • the execution node so that the execution node can obtain the security group association information of the terminal, the execution node can perceive the security group to which the terminal belongs according to the security group association information, so that the terminal's message can be processed according to the security group policy, which can be achieved
  • the separation of authentication nodes and execution nodes breaks the constraints on networking, expands the scope of applications, and improves compatibility.
  • FIG. 10 is a flowchart of an information synchronization method provided by an embodiment of the present application. As shown in FIG. 10, the method may be executed by a synchronization node, including the following steps:
  • the synchronization node receives the security group association information of the terminal sent by the authentication node.
  • the synchronization node may store the security group association information of the terminal.
  • the synchronization node may include a memory, and the security group association information of the terminal may be written into the A memory, so that the memory stores security group association information of the terminal.
  • the memory may include memory and external memory.
  • the memory may be dynamic random access memory (English: dynamic random access memory, DRAM for short).
  • the external memory may include a hard disk, a magnetic disk, and an optical disk.
  • the memory may be flash memory, NVMe solid state drive (English: solid state drives, abbreviated as: SSD).
  • the synchronization node may send the security group association information to the storage node, the storage node may receive the security group association information, and store the security group association information, and the synchronization node may subsequently query the security group association information from the storage node.
  • the storage node may include a local storage device and a network storage device, and the network storage device may be a cloud storage system.
  • the synchronization node may establish a first network connection with the synchronization node, and the synchronization node may receive the terminal's Security group association information.
  • the establishment process of the first network connection please refer to the foregoing embodiment of FIG. 9, and details are not described herein again.
  • the synchronization node may receive the encoded security group association information; decode the encoded security group association information to obtain the security group association information.
  • the synchronization node can receive the security group information in the protocol buffer format, analyze the security group information in the protocol buffer format, and obtain the security group association information.
  • the synchronization node may receive the compressed security group association information; decompress the compressed security group association information to obtain the security group association information.
  • the synchronization node can receive the security group information in the Zip format, decompress the security group information in the Zip format, and obtain the security group association information.
  • the synchronization node determines at least one execution node.
  • the at least one execution node determined by the synchronization node includes at least the target execution node.
  • the at least one execution node may include only the target execution node, or may include not only the target execution node, but also other execution nodes other than the target execution node.
  • the target execution node refers to an execution node used to process the message of the terminal mentioned in step 1001 according to the security group policy. That is, after obtaining the security group association information of the terminal, the synchronization node can at least determine the target execution node that subsequent messages of the terminal will reach, and synchronize the terminal security group association information to the target execution node.
  • the exclusion also determines the situation where other execution nodes are identified, which is not limited in this embodiment.
  • the synchronization node may store the network address of at least one execution node in advance, and the synchronization node determines the at least one execution node, which may include: the synchronization node reads the stored network address of the at least one execution node.
  • the synchronization node can send the network address request to the execution node, and the execution node can receive the network address request and send the local network address to the synchronization node.
  • the synchronization node can receive the network address of the execution node and store the network address of the execution node. In this way, the synchronization node can actively discover the network address of each execution node accessing the network.
  • the execution node when any execution node accesses the network, can send the local network address to the synchronization node, and the synchronization node can receive the network address of the execution node and store the network address of the execution node .
  • the network address of the execution node can also be stored in other ways.
  • the administrator can trigger the configuration operation on the synchronization node. Accordingly, the synchronization node can receive the configuration instructions and follow the configuration instructions The network address of the execution node is obtained in this embodiment. In this embodiment, the manner in which the synchronization node stores the network address of the execution node is not limited.
  • the synchronization node may store the identifier of at least one execution node in advance, and the synchronization node determines the at least one execution node, which may include: the synchronization node reads the stored identifier of the at least one execution node.
  • the manner in which the synchronization node stores the identification of the execution node is the same as in the previous paragraph, and will not be repeated here.
  • the process of the synchronization node determining at least one execution node may include the following implementation manner 1 to implementation manner 2:
  • the synchronization node determines the target execution node.
  • the synchronization node may determine the target execution node corresponding to the target network segment from the correspondence between the network segment and the execution node according to the target network segment to which the terminal's network address belongs.
  • the target network segment refers to the network segment to which the terminal's network address belongs.
  • the synchronization node may acquire the target network segment according to the network address of the terminal.
  • the correspondence between the network segment and the execution node may include at least one network segment and the identification of at least one execution node. Any execution node in the correspondence between the network segment and the execution node may correspond to one or more network segments.
  • the identifier of the execution node is used to identify the corresponding execution node.
  • the identifier of the execution node may be an identification number (ID), number, name, serial number, etc. of the execution node.
  • ID identification number
  • the correspondence between the network segment and the execution node can be shown in Table 4 below.
  • Execution node network segment Execution node 1 202.178.100.0/24 Execution node 2 202.178.200.0/24 Execution node 3 202.178.300.0/24
  • the synchronization node may receive a configuration instruction, which is used to indicate the correspondence between the network segment and the execution node.
  • the synchronization node can parse the configuration instruction to obtain the correspondence between the network segment and the execution node.
  • the configuration instruction can be triggered by the configuration operation of the administrator.
  • the synchronization node can support the function of security group subscription configuration to meet the user's custom needs.
  • Implementation method 2 The synchronization node determines each execution node in the network.
  • the synchronization node determining each execution node in the network may include: the synchronization node determining the network address of each execution node in the network.
  • the synchronization node may store the network address of each execution node in the network in advance, and may read the stored network address of each execution node.
  • the synchronization node determining each execution node in the network may include: the synchronization node determining each execution node in the network.
  • the synchronization node can read the stored identification of each execution node in the network.
  • the synchronization node may store the identifier of each execution node in the network in advance, and the stored identifier of each execution node may be read.
  • the security group association information can be achieved by pushing the security group association information to each execution node in the network.
  • the effect of pushing to the target execution node in the network can ensure that the target execution node can obtain the security group association information.
  • the synchronization node may encode the security group association information according to the structured data format.
  • the structured data format may be a protocol buffer format.
  • the synchronization node may compress the security group association information.
  • any compression algorithm may be used to compress the security group-related information.
  • the compression algorithm may include a Zip (zip) compression algorithm.
  • the synchronization node sends the security group association information to at least one execution node.
  • the synchronization node may send the security group association information of the terminal to the target execution node corresponding to the target network segment. Further, optionally, the synchronization node may receive the security group association information of multiple terminals, and according to the correspondence between the network segment and the execution node, send the security group association information of the terminals of different network segments to different target execution nodes .
  • network segment 1 corresponds to execution node 1
  • network segment 2 corresponds to execution node 2
  • network segment 3 corresponds to execution node 3
  • the synchronization node can send the security group association information of all terminals whose network addresses belong to network segment 1.
  • To execution node 1 send the security group association information of all terminals whose network address belongs to network segment 2 to execution node 2
  • the effect achieved can at least include: when the synchronization node receives the security group information of the terminals in different network segments, each security group information can be sent to the execution node of the corresponding network segment separately, and each execution node can be realized
  • the function of receiving the security group information of the terminal of the local network segment achieves the effect of refined push, which can avoid the execution node consuming operating resources due to frequent reception of security group information.
  • the storage resources of the execution node can be saved, and the amount of data of the security group associated information to be stored by a single execution node is too large.
  • the amount of data of the security group information to be synchronized by the synchronization node is huge, and by finely transmitting the security group information, the operating efficiency of the entire system can be improved.
  • the synchronization node may send the security group association information of the terminal to each execution node of the network. Further, optionally, the synchronization node may send the security group association information of any terminal to each execution node of the network whenever it receives the security group association information of any terminal.
  • the synchronization node may establish a second network connection with the at least one execution node, and then may send the security group association information to the second network connection At least one execution node.
  • the second network connection refers to the network connection between the synchronization node and at least one execution node.
  • the second network connection response is used to confirm the establishment of the second network connection.
  • the second network connection belongs to at least one of encrypted channel, long connection, and connection multiplexing.
  • the authentication node and at least one execution node may use an encryption algorithm to encrypt the transmitted information, thereby improving information transmission Security.
  • the encryption algorithm may include a symmetric encryption algorithm, an asymmetric encryption algorithm, and the like.
  • the authentication node and at least one execution node may perform bidirectional certificate authentication, that is, the authentication node may authenticate the digital certificate of at least one execution node, and at least one execution node may authenticate the authentication node Digital certificate.
  • the authentication node and at least one execution node may continuously send multiple times of security group association information through the second network connection, thereby saving performance overhead when connecting multiple times.
  • the second network connection is connection multiplexing
  • multiple requests and/or responses transmitted between the authentication node and at least one execution node may multiplex one connection, thereby reducing the number of connections and improving the efficiency of information transmission.
  • the second network connection may be a network connection established based on the HTTP2.0 protocol.
  • the network connection established based on the HTTP2.0 protocol is only an example description of the second network connection.
  • the synchronization node and at least one execution node can establish a network connection through any network communication protocol, for example, through an application layer protocol.
  • the application layer protocol includes but is not limited to netcof protocol, RTMP protocol, etc. This embodiment does not limit the network communication protocol between the synchronization node and at least one execution node.
  • the synchronization node may be a client of the second network connection, and at least one execution node may be a server of the second network connection.
  • the synchronization node may generate a second network connection request and send a second network connection request to at least one execution node, where the second network connection request is used to request establishment of a second network connection between the synchronization node and at least one execution node; at least one execution
  • the node sends a second network connection response to the synchronization node.
  • the second network connection response is used to confirm the establishment of the second network connection.
  • the synchronization node may receive the second network connection response of at least one execution node.
  • the synchronization node is a client connected to the second network, and the manner in which at least one execution node is the server connected to the second network is only described by way of example.
  • the synchronization node may also be a server connected to the second network, and at least one execution node is For the client of the second network connection, this embodiment does not limit the process of establishing the second network connection.
  • the effect achieved may include at least: the second network connection may be a bidirectional connection, that is, when data is transmitted between the synchronization node and any execution node, the synchronization node and the authentication node pass the client and
  • the server mode only needs to configure a network connection, which greatly reduces the workload of configuration operations, and reduces the workload of later operation and maintenance brought by the maintenance of network connections.
  • the connection configuration of the mesh topology English: full-mesh
  • this step may include: sending the encoded security group association information to the synchronization node, that is, the structured security
  • the group association information is sent to at least one execution node.
  • the synchronization node may send the security group association information in the protocol buffer format to at least one execution node.
  • this step may include sending the compressed security group association information to at least one execution node.
  • the synchronization node may send the security group association information in the Zip format to at least one execution node.
  • the security group association information of the terminal may be updated. Accordingly, the method provided in this embodiment may further include the following steps 1 to 3:
  • Step 1 The synchronization node receives the updated security group association information of the terminal sent by the authentication node, and the updated security group association information is used to indicate the mapping relationship between the updated network address of the terminal and the security group, or, after the update
  • the security group association information is used to indicate the mapping relationship between the terminal’s network address and the updated security group to which the terminal belongs, or the updated security group association information is used to indicate the terminal’s updated network address and the terminal’s The mapping relationship between the updated security groups.
  • the synchronization node may update the stored security group association information of the terminal to the updated security group association information, thereby ensuring the accuracy of the stored security group association information of the terminal.
  • Step 2 The synchronization node determines at least one execution node.
  • Step 3 The synchronization node sends the updated security group association information to at least one execution node.
  • the effect can at least include: if the current position of the terminal changes, the network address of the terminal can be updated, and the synchronization node can update the updated security group with the update of the network address of the terminal
  • the association information is issued to the execution node, so that the execution node can obtain the updated security group association information of the terminal to ensure the accuracy of the terminal security group association information stored by the execution node.
  • the synchronization node synchronizes the security group association information from the authentication node to the execution node, so that the execution node can obtain the security group association information of the terminal, and then the execution node can perceive the terminal according to the security group association information
  • the security group to which it belongs can process the messages of the terminal according to the security group policy, which can achieve the separation of the authentication node and the execution node, breaking the constraints on the networking, expanding the scope of application, and improving compatibility.
  • FIG. 12 is a flowchart of a message processing method provided by an embodiment of the present application. As shown in FIG. 12, the execution subject of the method may be an execution node, including the following steps:
  • the execution node receives the security group association information of the terminal sent by the synchronization node.
  • the execution node may store the security group association information of the terminal.
  • the execution node may include a memory, and the security group association information of the terminal may be written into the A memory, so that the memory stores security group association information of the terminal.
  • the execution node may send the security group association information to the storage node, the storage node may receive the security group association information, and store the security group association information, and the execution node may subsequently query the security group association information from the storage node.
  • the execution node may establish a second network connection with the synchronization node, and may receive the security group of the terminal sent by the synchronization node through the second network connection
  • the second network connection may be established with the synchronization node, and may receive the security group of the terminal sent by the synchronization node through the second network connection
  • the process of establishing the second network connection please refer to the above-mentioned embodiment of FIG. 10, which will not be repeated here.
  • the execution node may receive the encoded security group association information; decode the encoded security group association information to obtain the security group association information.
  • the execution node may receive the security group information in the structured data format, parse the security group association information in the structured data format, and obtain the security group association information.
  • the execution node may receive the security group information in the protocol buffer format, parse the security group information in the protocol buffer format, and obtain the security group association information.
  • the execution node may receive the compressed security group association information; decompress the compressed security group association information to obtain the security group association information.
  • the execution node may receive the security group information in the Zip format, decompress the security group information in the Zip format, and obtain the security group association information.
  • the execution node receives the message of the terminal.
  • the message of the terminal is used to carry the service data of the terminal.
  • the message can be generated by the terminal and sent to the execution node.
  • the data transmitted in different layers of the network can have different names.
  • the term packet can be equivalently replaced with other terms.
  • the packet can also be called a data packet or packet ( Packets), data packets, etc.
  • messages can also be called frames.
  • the message of the terminal may include at least one of a message transmitted between two different terminals and a message transmitted between the terminal and the network resource.
  • the message transmitted between two different terminals can be regarded as the message generated by the access behavior between the two terminals, for example, it can include a message sent by one terminal to another terminal and a terminal received by another terminal At least one item in the message.
  • the packet transmitted between the terminal and the network resource can be regarded as a packet generated by the access behavior between the terminal and the network resource, for example, it can include a packet sent by a terminal to the network resource and a packet received by the terminal from the network resource At least one item.
  • the execution node receiving the packet of the terminal may include: the execution node receiving the traffic of the terminal.
  • This flow is also called data flow or packet flow, and refers to multiple consecutive packets.
  • the quintuple of the same flow can be the same.
  • the message between the execution node and the terminal may be forwarded by the authentication node.
  • the message received by the execution node from the terminal may include: the authentication node receives the message of the terminal, and the authentication node sends the message of the terminal to the execution The node, the execution node receives the terminal message sent by the authentication node.
  • the execution node obtains the security group corresponding to the network address from the security group association information according to the network address carried in the message.
  • the execution node can parse the message to obtain the network address carried in the message, query the security group association information according to the network address, and obtain the security group corresponding to the network address in the security group association information. For example, assuming that the security group association information is shown in Table 1 above, if the execution node receives a packet carrying a network address of "128.107.162.22", the security group corresponding to the network address can be obtained from the security group association information as security Group 100.
  • the network address carried in the message may include a source network address and a destination network address. Accordingly, this step 1203 may include any one or more of the following combinations (1) to (2).
  • the security group association information corresponding to the source network address is called the first security group association information
  • the security group association information corresponding to the destination network address is called the second security group association information
  • the source network address corresponds to
  • the security group is called the first security group
  • the security group corresponding to the destination network address is called the second security group.
  • first security group association information and “first security group association information” are used to distinguish different security group association information, and should not be understood as an explicit or implicit relationship between different security group association information in time or logic For example, it should not be construed as expressing or implying the generation time, reception time, order of storage time and relative importance of the associated information of different security groups.
  • first security group and “second security group” are used to distinguish between different security groups, and should not be understood as an explicit or implied relationship between different security groups in time or logic, for example, should not be understood as Express or imply the generation time, reception time, storage time order and relative importance of different security groups.
  • the source network address may be the source IP address of the message, and the terminal may query the security group association information according to the source network address to obtain the security group corresponding to the source network address.
  • the first security group since the first security group is a security group corresponding to the source network address, the first security group may be called a source security group.
  • the destination network address may be the destination IP address of the packet, and the terminal may query the security group association information according to the destination network address to obtain the security group corresponding to the destination network address.
  • the second security group since the second security group is the security group corresponding to the destination network address, the second security group may be referred to as the destination security group.
  • (1) in step 1203 and then (2) in step 1203 are only for convenience of expression.
  • This embodiment has no timing for (1) and (2) in step 1203.
  • (1) in step 1203 can be executed first, and then (2) in step 1203 can be executed; for another example, (2) in step 1203 can be executed before (1) in step 1203; again, (1) in step 1203 and (2) in step 1203 may be performed simultaneously.
  • (1) in step 1203 and (2) in step 1203 can be executed either or both.
  • the The security groups can all be determined by the security group association information, and the execution node can execute (1) and (2).
  • the security group of the terminal can be determined by the security group association information, and the security group of the network resource can be determined by the configuration information, then the execution node can perform any of (1) and (2) Item, for the specific implementation of this scenario, please refer to the following Figure 17 to Figure 19 embodiments.
  • the execution node processes the message according to the security group policy matched by the security group.
  • the execution node may match the security group policy corresponding to the security group according to the security group to which the terminal belongs.
  • the execution node may obtain the security group policy matching the security group from the correspondence between the security group and the security group policy according to the security group to which the terminal belongs.
  • the correspondence between the security group and the security group policy is used to indicate the security group policy corresponding to any security group.
  • the correspondence between the security group and the security group policy may include the identification of at least one security group and the identification of at least one security group policy.
  • the identifier of the security group policy is used to indicate the corresponding security group policy, which may be the name, number, keyword, serial number, etc. of the security group.
  • the correspondence between the security group and the security group policy is used to indicate the security group policy corresponding to the source security group and the security group policy corresponding to the destination security group.
  • the source security group refers to the security group corresponding to the source network address of the packet, and can be regarded as the security group to which the access device belongs.
  • the destination security group refers to the security group corresponding to the destination network address of the packet, and can be regarded as the security group to which the accessed device belongs.
  • the correspondence between the security group and the security group policy may be a security group policy matrix, and the rows and columns of the security group policy matrix may refer to one or more security groups.
  • the rows of the security group policy matrix may refer to one or more source security groups, and the rows of the security group policy matrix may refer to one or more destination security groups.
  • the correspondence between the security group and the security group policy may be as shown in Table 5 below.
  • the correspondence between the security group and the security group policy may be pre-stored on the execution node, and the execution node may read the stored security group and Correspondence between security group policies.
  • the correspondence between security groups and security group policies can be determined according to the user's configuration operations.
  • the execution node may receive a configuration instruction, which is used to indicate the correspondence between the security group and the security group policy.
  • the configuration instruction may be triggered according to the user's configuration operation, and the execution node may obtain the security group and
  • the correspondence between security group policies stores the correspondence between security groups and security group policies.
  • the execution node may according to the first security group corresponding to the source network address of the packet and the second security group corresponding to the destination network address, from the security group In the corresponding relationship with the security group policy, a security group policy that matches the first security group and matches the second security group is obtained.
  • the execution node may obtain the security group policy in which the source security group is the first security group and the destination security group is the second security group from the correspondence between the security group and the security group policy.
  • the group policy is the security group policy that matches the first security group and the security group policy that matches the second security group.
  • the terminal in a scenario where the terminal interacts with any device, assuming that the terminal wants to access another device, the terminal is a packet sending device, and the accessed device is a packet receiving device.
  • the execution node may obtain the source security group from the correspondence between the security group and the security group policy according to the first security group corresponding to the terminal's network address and the second security group corresponding to the network address of the accessed device.
  • the first security group and the destination security group are the security group policies of the second security group, and the security group policies are the security group policies that the packets match.
  • the terminal is a message receiving device
  • the accessed device is a message sending device.
  • the execution node may use the first security corresponding to the network address of the terminal Group and the second security group corresponding to the network address of the accessed device, from the correspondence between the security group and the security group policy, the security of the destination security group matching the first security group and the source security group being the second security group Group policy, the security group policy is the security group policy for packet matching.
  • the packet processing method according to the security group policy may include: forwarding the packet, discarding the packet, controlling the transmission bandwidth of the packet, controlling the transmission rate of the packet, and forwarding the control packet Priority, allocating transmission resources for messages, and storing messages in one or more of the specified priority queues.
  • the manner of processing packets in accordance with the security group policy may include the following (1) to (2):
  • the execution node can forward the terminal's message according to the access permission control policy, or discard the terminal's message. Specifically, if the access permission control policy is an allow access policy, the execution node may forward the message of the terminal according to the allow access policy. If the access permission control strategy is an access prohibition strategy, the executing node may discard the terminal's message according to the access prohibition strategy.
  • the execution node can control the traffic volume of the terminal's packets according to the experience assurance policy, for example, controlling the terminal's bandwidth within a range that does not exceed the bandwidth threshold In order to avoid network congestion, in accordance with the forwarding priority, the terminal's message is forwarded.
  • the source network address is the network address of the terminal of traveling employee a
  • the destination network address is that of traveling employee a
  • the execution node can obtain the first security group as a traveling employee and the second security group as an outsourcing employee according to the source network address of the packet; from the correspondence between the security group and the security group policy, it can be The security group policy that the outsourced employee matches, namely "Allow access to high priority", according to this security group policy, the traveling employee a will be allowed to access the outsourced employee b, and priority is transmitted between the terminal of the traveling employee a and the terminal of the outsourced employee b Message.
  • the security group association information of the terminal may be updated. Accordingly, the method provided in this embodiment may further include the following steps 1 to 4:
  • Step 1 The execution node receives the updated security group association information of the terminal sent by the synchronization node, and the updated security group association information is used to indicate the mapping relationship between the updated network address of the terminal and the security group, or, after the update
  • the security group association information is used to indicate the mapping relationship between the terminal’s network address and the updated security group to which the terminal belongs, or the updated security group association information is used to indicate the terminal’s updated network address and the terminal’s The mapping relationship between the updated security groups.
  • the execution node may update the stored security group association information of the terminal to the updated security group association information, thereby ensuring the accuracy of the stored security group association information of the terminal.
  • Step 2 The execution node receives the message from the terminal.
  • Step 3 The execution node obtains the security group corresponding to the network address from the updated security group association information according to the network address carried in the message.
  • Step 4 The execution node processes the message according to the security group policy matched by the security group.
  • the effect achieved can at least include: if the current location of the terminal changes, the terminal's network address and/or security group can be updated, and the execution node can follow the terminal's network address and/or security
  • the group can be updated to update the stored security group association information of the terminal to ensure the accuracy of the terminal security group association information stored by the execution node.
  • the execution node can obtain the security group association information of the terminal by synchronizing the security group association information delivered by the node, so as to be able to perceive the security group to which the terminal belongs.
  • the execution node can The terminal's messages are processed according to the security group policy, which realizes the separation of the authentication node and the execution node, breaks the constraints on the networking, expands the scope of application, and improves compatibility.
  • FIG. 13 is a flowchart of a service processing method provided by an embodiment of the present application.
  • the interaction body of the method includes a terminal, an authentication node, a synchronization node, and an execution node, including the following steps:
  • the terminal sends an authentication request to the authentication node.
  • the authentication node When the authentication node receives the authentication request of the terminal, the authentication node authenticates the terminal to obtain the security group to which the terminal belongs.
  • Step 1302 can be the same as step 901 to step 902 in the embodiment of FIG. 9 described above, and details are not described herein again.
  • the authentication node obtains the security group association information of the terminal according to the terminal's network address and security group.
  • Step 1303 may be the same as step 903 in the embodiment of FIG. 9 described above, and details are not described here.
  • the authentication node sends the security group association information to the synchronization node.
  • Step 1304 can be the same as 904 in the embodiment of FIG. 9 described above, and details are not described here.
  • the synchronization node determines at least one execution node including the target execution node, and the target execution node is used to process the terminal's message according to the security group policy.
  • Step 1305 can be the same as 1001 to 1002 in the above-described embodiment of FIG. 10, and details are not described here.
  • the synchronization node sends the security group association information to at least one execution node.
  • Step 1306 can be the same as 1003 in the above-mentioned embodiment of FIG. 10, and details are not described here.
  • the execution node receives the security group association information of the terminal sent by the synchronization node.
  • Step 1307 may be the same as 1201 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the terminal sends a message to the execution node.
  • the execution node When the execution node receives the message from the terminal, the execution node obtains the security group corresponding to the network address from the security group association information according to the network address carried in the message.
  • Step 1309 can be the same as 1202 to 1203 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the execution node processes the message according to the security group policy matched by the security group.
  • Step 1310 can be the same as 1204 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the method provided in this embodiment of the present application may be applied to a scenario where terminals that are accessed across authentication nodes access each other.
  • the specific implementation may be as shown in the following embodiments in FIG. 14 to FIG. 16.
  • any two different authentication nodes are called a first authentication node and a second authentication node, respectively, and a terminal authenticated by the first authentication node is called a first Terminal, the terminal authenticated by the second authentication node is called the second terminal, the security group to which the first terminal belongs is called the first security group, and the security group to which the second terminal belongs is called the second security group, which will be received
  • the execution node of the message transmitted between the first terminal and the second terminal is called a first target execution node.
  • FIG. 14 is a flowchart of an information synchronization method provided by an embodiment of the present application. As shown in FIG. 14, the method may be executed by a synchronization node, including the following steps:
  • the synchronization node receives the first security group association information of the first terminal sent by the first authentication node.
  • the first security group association information is used to indicate a mapping relationship between the network address of the first terminal and the first security group to which the first terminal belongs.
  • the first security group association information may include the network address of the first terminal and the group identification of the first security group.
  • the first security group association information may be generated during the authentication process of the first terminal by the first authentication node.
  • the process that the first authentication node authenticates the first terminal may include: the first authentication node receives the authentication request of the first terminal, and the first authentication node authenticates the first terminal to obtain the first security group to which the first terminal belongs Obtain the first security group association information of the first terminal according to the network address of the first terminal and the first security group; send the first security group association information to the synchronization node.
  • the process reference may be made to the embodiment in FIG. 9 described above, and details are not described herein.
  • the synchronization node may receive the encoded first security group association information; decode the encoded first security group association information to obtain the first security group association information ;
  • the synchronization node may receive the compressed security group association information; decompress the compressed first security group association information to obtain the first security group association information.
  • the synchronization node receives the second security group association information of the second terminal sent by the second authentication node.
  • the second authentication node is different from the first authentication node, and the second authentication node and the first authentication node may be any two different authentication nodes in the network.
  • the second authentication node and the first authentication node may be deployed in different geographic locations.
  • the second security group association information is used to indicate a mapping relationship between the network address of the second terminal and the second security group to which the second terminal belongs.
  • the second security group association information may include the network address of the second terminal and the group identification of the second security group.
  • the second security group association information may be generated during the authentication process of the second terminal by the second authentication node.
  • the process for the second authentication node to authenticate the second terminal may include: the second authentication node receives the authentication request of the second terminal, and the second authentication node authenticates the second terminal to obtain the second security group to which the second terminal belongs Obtain the second security group association information of the second terminal according to the network address of the second terminal and the second security group; send the second security group association information to the synchronization node.
  • the process may refer to the above-mentioned embodiment of FIG. 10, and will not be repeated here.
  • step 1401 and then step 1402 is only for convenience of expression.
  • the two steps of step 1401 and step 1402 are not limited in time sequence.
  • step 1401 can be performed first, and then step 1402 can be performed; for example, step 1402 can be performed first, and then step 1401 can be performed; for example, step 1401 and step 1402 can be performed simultaneously.
  • the synchronization node may receive the encoded second security group association information; decode the encoded second security group association information to obtain the second security group association information .
  • the synchronization node may receive the compressed security group association information; decompress the compressed second security group association information to obtain the second security Group related information.
  • the synchronization node determines at least one execution node that includes the first target execution node, and the first target execution node is configured to process the message transmitted between the first terminal and the second terminal according to the security group policy.
  • the process of the synchronization node determining at least one execution node may include the following implementation manner 1 to implementation manner 2:
  • Implementation method 1 The synchronization node determines the first target execution node.
  • implementation one may include: the synchronization node obtains the first corresponding to the first target network segment from the correspondence between the network segment and the execution node according to the first target network segment to which the network address of the first terminal belongs Target execution node; obtaining the first target execution node corresponding to the second target network segment from the correspondence between the network segment and the execution node according to the second target network segment to which the network address of the second terminal belongs.
  • the first target network segment refers to the network segment to which the network address of the first terminal belongs
  • the second target network segment refers to the network segment to which the network address of the second terminal belongs.
  • the first target network segment and the second target network segment may be different, and the execution node corresponding to the first target network segment and the execution node corresponding to the second target network segment are the same, the first target network segment and the second target network
  • the execution nodes corresponding to the segments are all the first target execution nodes.
  • the first target network segment and the second target network segment may be the same, and the execution nodes corresponding to the first target network segment and the second target network segment are both the first target execution node.
  • Implementation method 2 Determine each execution node in the network.
  • the synchronization node may encode the first security group association information according to the structured data format to obtain the encoded first security group association information.
  • the synchronization node may compress the first security group association information to obtain the compressed first security group association information.
  • the synchronization node sends the first security group association information to at least one execution node.
  • Step 1404 may be the same as 1003 in the above-mentioned embodiment of FIG. 10, and details are not described here.
  • the synchronization node may send the encoded first security group association information to at least one execution node.
  • the synchronization node may send the compressed first security group association information to at least one execution node.
  • the security group association information of at least one of the first terminal and the second terminal may be updated, and accordingly, the authentication node may send the updated security group association information of the first terminal to the synchronization node, or Send the updated security group association information of the second terminal to the synchronization node.
  • the case where the security group association information of the first terminal is updated may include at least one of the following cases (1) to (3).
  • Case (1) The network address of the first terminal is updated, and the method executed by the authentication node may further include the following steps (1.1) to (1.3):
  • Step (1.1) The first authentication node obtains the updated network address of the first terminal.
  • the first terminal may send the updated network address to the first authentication node, and the first authentication node may receive the updated network address of the first terminal, thereby being updated Network address.
  • the first terminal may send the updated network address to the authentication point device, and the first authentication point device may receive the updated network address of the first terminal, and update the updated The network address is sent to the authorized device.
  • the first authentication point device may generate a network address update request according to the updated network address of the first terminal, where the first network address update request carries the updated network address, the authorized device may receive the first network address update request , Parse the first network address update request to obtain the updated network address.
  • Step (1.2) The first authentication node obtains the updated first security group association information of the first terminal according to the updated network address and the first security group.
  • the updated first security group association information is used to indicate the mapping relationship between the updated network address and the first security group to which the first terminal belongs.
  • the updated first security group association information may include the updated network address of the first terminal and the group identifier of the first security group.
  • Step (1.3) The first authentication node sends the updated first security group association information to the synchronization node.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated first security group association information of the first terminal sent by the first authentication node;
  • Step b The synchronization node sends the updated first security group association information to at least one execution node;
  • the updated first security group association information is used to indicate the mapping relationship between the updated network address of the first terminal and the first security group.
  • Case (2) The security group to which the first terminal belongs is updated.
  • the method performed by the authentication node may further include the following steps (2.1) to (2.3):
  • Step (2.1) The first authentication node obtains the updated first security group of the first terminal.
  • the first authentication node may obtain the updated authentication information of the first terminal, and obtain the first terminal from the correspondence between the authentication information and the first security group according to the updated authentication information of the first terminal The updated first security group to which it belongs.
  • the updated authentication information may include updated location information, updated other information, updated user information, and so on.
  • the updated location information is used to indicate the updated location of the first terminal.
  • the updated other information may include an updated time period and an updated first terminal group.
  • the updated user information may include the updated location. Department, updated role, updated account, etc.,
  • the updated first security group acquisition method may include any one or a combination of any one of the following methods 1 to 2.
  • the first authentication node may acquire the updated location information of the first terminal, and obtain the updated location of the first terminal from the correspondence between the location information and the first security group according to the updated location information The first security group.
  • the correspondence between the location information and the first security group may include at least one location information and at least one identifier of the first security group, and the correspondence between the location information and the first security group may be at the first authentication node On the pre-configuration, for example on the 3A server pre-configuration.
  • the first authentication node may obtain the updated time period, and obtain the updated first security group to which the first terminal belongs from the correspondence between the time period and the first security group according to the updated time period .
  • the correspondence between the time period and the first security group may include at least one time period and at least one identifier of the first security group.
  • the correspondence between the time period and the first security group may be pre-configured on the first authentication node.
  • Step (2.2) The first authentication node obtains the updated first security group association information of the first terminal according to the network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the updated first security group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the updated first security group association information may include the network address of the first terminal and the updated group identifier of the first security group.
  • Step (2.3) The first authentication node sends the updated first security group association information of the first terminal to the synchronization node.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated first security group association information of the first terminal sent by the first authentication node;
  • Step b The synchronization node sends the updated first security group association information to at least one execution node;
  • the updated first security group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs.
  • Case (3) The network address of the first terminal and the security group to which the first terminal belongs are updated. Accordingly, the method provided in this embodiment may further include the following steps (3.1) to (3.3):
  • Step (3.1) The first authentication node obtains the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • Step (3.1) is the same as the above step (1.1) and step (1.2), and will not be repeated here.
  • the updated first security group association information is used to indicate a mapping relationship between the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the updated first security group association information may include the updated network address of the first terminal and the updated group identifier of the first security group.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated first security group association information of the first terminal sent by the first authentication node;
  • Step b The synchronization node sends the updated first security group association information to at least one execution node;
  • the updated first security group association information is used to indicate a mapping relationship between the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the second security group association information of the second terminal may also be updated, and the update of the second security group association information may include at least one of the following cases (1) to (3) item.
  • Case (1) The network address of the second terminal is updated, and the method performed by the authentication node may further include the following steps (1.1) to (1.3):
  • Step (1.1) The second authentication node obtains the updated network address of the second terminal.
  • the second terminal may send the updated network address to the second authentication node, and the second authentication node may receive the updated network address of the second terminal, thereby being updated Network address.
  • the second terminal may send the updated network address to the second authentication point device, and the authentication point device may receive the updated network address of the second terminal, and update the updated The network address is sent to the authorized device.
  • the authentication point device may generate a network address update request according to the updated network address of the second terminal, where the network address update request carries the updated network address, then the authorized device may receive the network address update request and respond to the network address update request Perform analysis to get the updated network address.
  • Step (1.2) The second authentication node obtains updated second security group association information of the second terminal according to the updated network address and the second security group.
  • the updated second security group association information is used to indicate the mapping relationship between the updated network address and the second security group to which the second terminal belongs.
  • the updated second security group association information may include the updated network address of the second terminal and the group identifier of the second security group.
  • Step (1.3) The second authentication node sends the updated second security group association information to the synchronization node.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated second security group association information of the second terminal sent by the second authentication node;
  • Step b The synchronization node sends the updated second security group association information to at least one execution node
  • the updated second security group association information is used to indicate the mapping relationship between the updated network address of the second terminal and the second security group.
  • Case (2) The security group to which the second terminal belongs is updated. Accordingly, the method provided in this embodiment may further include the following steps (2.1) to (2.3):
  • Step (2.1) The second authentication node obtains the updated second security group of the second terminal.
  • the second authentication node may obtain the updated authentication information of the second terminal, and obtain the second terminal from the correspondence between the authentication information and the second security group according to the updated authentication information of the second terminal Belongs to the updated second security group.
  • the updated authentication information may include updated location information, updated other information, updated user information, and so on.
  • the updated location information is used to indicate the updated location of the second terminal.
  • the updated other information may include an updated time period and an updated second terminal group.
  • the updated user information may include the updated location. Department, updated role, updated account, etc.,
  • the updated second security group acquisition mode may include any one or a combination of any one of the following modes 1 to 2.
  • the second authentication node may obtain the updated location information of the second terminal, and obtain the updated location of the second terminal from the correspondence between the location information and the second security group according to the updated location information The second security group.
  • the correspondence between the location information and the second security group may include at least one location information and at least one identifier of the second security group, and the correspondence between the location information and the second security group may be at the second authentication node Pre-configured, for example, pre-configured on the 3A server.
  • the second authentication node may obtain the updated time period, and obtain the updated second security group to which the second terminal belongs from the correspondence between the time period and the second security group according to the updated time period .
  • the correspondence between the time period and the second security group may include at least one time period and at least one identification of the second security group.
  • the correspondence between the time period and the second security group may be pre-configured on the second authentication node.
  • Step (2.2) The second authentication node obtains the updated second security group association information of the second terminal according to the network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the updated second security group association information is used to indicate a mapping relationship between the network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the updated second security group association information may include the network address of the second terminal and the updated group identifier of the second security group.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated first security group association information of the first terminal sent by the first authentication node;
  • Step b The synchronization node sends the updated first security group association information to at least one execution node;
  • the updated first security group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs.
  • Case (3) The network address of the second terminal and the second security group to which the second terminal belongs are updated. Accordingly, the method provided in this embodiment may further include the following steps (3.1) to (3.3):
  • Step (3.1) The second authentication node obtains the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • step (3.1) is the same as the above step (1.1) and step (1.2), and will not be repeated here.
  • Step (3.2) The second authentication node obtains updated second security group association information of the second terminal according to the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the updated second security group association information is used to indicate the mapping relationship between the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the updated second security group association information may include the updated network address of the second terminal and the updated group identifier of the second security group.
  • Step (3.3) The second authentication node sends the updated second security group association information of the second terminal to the synchronization node.
  • the method provided in this embodiment may include the following steps a to b:
  • Step a The synchronization node receives the updated second security group association information of the second terminal sent by the second authentication node;
  • Step b The synchronization node sends the updated second security group association information to at least one execution node
  • the updated second security group association information is used to indicate a mapping relationship between the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the synchronization node synchronizes the first security group association information of the first terminal and the second security group association information of the second terminal to the execution node, so that the execution node can hold two different authentication nodes at the same time.
  • the security group association information of the authenticated terminal so that the execution node can perceive the security group to which the terminal authenticated from two different authentication nodes belongs, then when the execution node receives the message transmitted from the terminal authenticated by the two different authentication nodes At this time, the message can be processed in accordance with the security group policy matching the security groups to which the two terminals belong, and the authority of mutual access between terminals accessed across authentication nodes can be controlled.
  • the execution subject may be an execution node, including the following steps:
  • the execution node receives the first security group association information of the first terminal sent by the synchronization node.
  • Step 1501 may be the same as 1201 in the embodiment of FIG. 12 described above, and details are not described here.
  • the execution node may receive the encoded first security group association information; decode the encoded first security group association information to obtain the first security group association information .
  • the execution node may receive the compressed first security group association information; decompress the compressed first security group association information to obtain the first security group association information.
  • the execution node receives the second security group association information of the second terminal sent by the synchronization node.
  • Step 1502 can be the same as 1201 in the embodiment of FIG. 12 described above, and details are not described here.
  • step 1501 and then step 1502 are only for convenience of expression.
  • the steps 1501 and 1502 are not limited in time sequence.
  • step 1501 can be performed first, and then step 1502 can be performed; for example, step 1502 can be performed first, and then step 1501 can be performed; for example, step 1501 and step 1502 can be performed simultaneously.
  • the execution node may receive the encoded second security group association information; decode the encoded second security group association information to obtain the second security group association information .
  • the execution node may receive the compressed second security group association information; decompress the compressed second security group association information to obtain the second security group association information.
  • the execution node receives the message transmitted between the first terminal and the second terminal.
  • the message transmitted between the first terminal and the second terminal may include at least one of a message sent by the first terminal to the second terminal and a message sent by the second terminal to the first terminal.
  • the source network address of the message may be the network address of the first terminal
  • the destination network address of the message may be the network address of the second terminal; accordingly, step 1503 It may include: the execution node receives the message sent by the first terminal and to be sent to the second terminal.
  • step 1503 may include: the execution node receives the message sent by the second terminal and to be sent to the first terminal.
  • the execution node obtains the first security group and the second security group corresponding to the network address from the security group association information according to the network address carried in the message.
  • the executing node By executing steps 1501 and 1502, the executing node obtains the security group association information of the first terminal authenticated by the first authentication node and the security group association information of the second terminal authenticated by the second authentication node, thereby simultaneously holding With the security group association information of the terminals accessed from different authentication nodes, when a message transmitted between different terminals reaches the execution node, the execution node can control the security of the different terminals through the security group association information of different terminals. Mutual access rights.
  • step 1504 may include the following (1.1) and (1.2).
  • (1.2) Obtain the second security group corresponding to the destination network address from the second security group association information according to the destination network address carried in the packet, and the destination network address is the network address of the second terminal. Specifically, if the destination network address of the packet is the network address of the second terminal, the second security group to which the second terminal belongs can be determined according to the network address of the second terminal and the second security group association information of the second terminal .
  • step 1504 may include the following (2.1) and (2.2).
  • (2.2) Obtain the first security group corresponding to the destination network address from the first security group association information according to the destination network address carried in the message. Specifically, if the destination network address of the packet is the network address of the first terminal, the first security group to which the first terminal belongs can be determined according to the network address of the first terminal and the first security group association information of the first terminal .
  • the execution node processes the message according to the security group policy that matches the first security group and matches the second security group.
  • the execution node may match the security group policies corresponding to the first security group and the second security group according to the first security group to which the first terminal belongs and the second security group to which the second terminal belongs.
  • the execution node may obtain the first security from the correspondence between the security group and the security group policy according to the first security group to which the first terminal belongs and the second security group to which the second terminal belongs The security group policy corresponding to the group and the second security group.
  • the correspondence between the security group and the security group policy please refer to 1204 in the embodiment of FIG. 12 above, which will not be repeated here.
  • the source security group is the first security group and the destination security group is the second security group.
  • the security group policy is called the first security group policy
  • the security group policy with the source security group as the second security group and the destination security group as the first security group is called the second security group policy.
  • the manner of matching the security group policy may include: obtaining the first security group policy from the correspondence between the security group and the security group policy.
  • the packet is a packet sent by the terminal of the traveling employee to the terminal of the outsourcing employee
  • the source security group is the traveling employee
  • the destination security group is the outsourced employee.
  • the way to match the security group policy may include : From the corresponding relationship between the security group and the security group policy, obtain the security group policy of the source security group as the traveling employee and the destination security group as the outsourced employee, that is, "allow access to low priority".
  • the manner of matching the security group policy may include: obtaining the second security group policy from the correspondence between the security group and the security group policy.
  • the security group policy may include: From the correspondence between the security group and the security group policy, obtain the security group policy that the source security group is the outsourced employee and the destination security group is the traveling employee, that is, "access is prohibited".
  • the first security group policy and the second security group policy may be different.
  • the processing method for the message sent by the first terminal to the second terminal and the processing method for the message sent by the second terminal to the first terminal may be different.
  • it may include any one or more of the following implementation (1) and implementation (2).
  • the access permission control strategy in the first security group policy and the access permission control strategy in the second security group policy may be different, so as to realize the first terminal's access right to the second terminal and the second terminal's access right to the first terminal
  • the functions with different rights may, for example, allow the first terminal to access the second terminal and prohibit the second terminal from accessing the first terminal.
  • the terminal of the administrator may be allowed to access the terminal of the outsourced employee, and the terminal of the outsourced employee may be prohibited from accessing the terminal of the administrator.
  • the experience assurance strategy in the first security group policy and the experience assurance strategy in the second security group policy may be different, so as to realize the quality of service of the first terminal accessing the second terminal and the service of the second terminal accessing the first terminal For functions with different qualities, for example, it is possible to forward packets with a first terminal access to a second terminal with high priority, and to forward packets with a second terminal access to the first terminal with low priority.
  • first security group policy and the second security group policy is only an optional method, and the first security group policy and the second security group policy may also be the same, which is not limited in this embodiment.
  • the security group association information of at least one of the first terminal and the second terminal may be updated.
  • the method provided in this embodiment may further include the following steps (1.1) to (1.4):
  • Step (1.1) The execution node receives the updated first security group association information of the first terminal sent by the synchronization node, and the updated first security group association information is used to indicate the updated network address and the first security of the first terminal.
  • the mapping relationship between the groups, or the updated first security group association information is used to indicate the mapping relationship between the network address of the first terminal and the updated first security group to which the first terminal belongs, or, after the update
  • the first security group association information is used to indicate the mapping relationship between the updated network address of the first terminal and the updated first security group to which the first terminal belongs.
  • the execution node may update the stored first security group association information of the first terminal to the updated first security group association information.
  • Step (1.2) The execution node receives the message transmitted between the first terminal and the second terminal.
  • the source network address of the message may be the updated network address of the first terminal, and the destination network address of the message may remain unchanged, which is still the second terminal Network address.
  • the source network address of the packet may remain unchanged, which is still the network address of the second terminal, and the destination network address of the packet may be the updated network of the first terminal address.
  • Step (1.3) The execution node obtains the first security group corresponding to the updated network address of the first terminal from the updated first security group association information and the second security group association information according to the network address carried in the message , And a second security group corresponding to the network address of the second terminal.
  • Step (1.4) The execution node processes the message according to the security group policy matching the first security group and matching the second security group.
  • the method provided in this embodiment may further include the following steps (2.1) to (2.4):
  • Step (2.1) The execution node receives the updated second security group association information of the second terminal sent by the synchronization node, and the updated second security group association information is used to indicate the updated network address and second security of the second terminal
  • the mapping relationship between the groups, or the updated second security group association information is used to indicate the mapping relationship between the network address of the second terminal and the updated second security group to which the second terminal belongs, or, after the update
  • the associated information of the second security group is used to indicate the mapping relationship between the updated network address of the second terminal and the updated second security group to which the second terminal belongs.
  • the execution node may update the stored second security group association information of the second terminal to the updated second security group association information.
  • Step (2.2) The execution node receives the message transmitted between the first terminal and the second terminal.
  • the source network address of the packet may remain unchanged, and is still the network address of the first terminal, and the destination network address of the packet may be the updated value of the second terminal Network address.
  • the source network address of the message may be the updated network address of the second terminal, and the destination network address of the message may remain unchanged, which is still the network of the first terminal address.
  • Step (2.3) The execution node obtains the first security group corresponding to the network address of the first terminal from the first security group association information and the updated second security group association information according to the network address carried in the message, and the first The second security group corresponding to the updated network address of the second terminal.
  • Step (2.4) The execution node processes the message according to the security group policy matching the first security group and matching the second security group.
  • steps (1.1) to (1.4) and steps (2.1) to (2.4) are only optional steps, not mandatory steps.
  • the above steps (1.1) to step (1.4) and step (2.1) to step (2.4) may be executed alternatively, or all may be executed.
  • the execution node can simultaneously hold terminals authenticated by two different authentication nodes by receiving the first security group association information of the first terminal and the second security group association information of the second terminal sent by the synchronization node Security group association information, so as to be able to perceive the security group to which terminals authenticated from two different authentication nodes belong, then when the execution node receives a message transmitted between terminals authenticated by two different authentication nodes, it can follow the two The security group policies to which the security groups to which the terminals belong match and process the packets, so as to be able to control the authority of mutual access between terminals accessed across authentication nodes.
  • FIG. 16 is a flowchart of a service processing method provided by an embodiment of the present application.
  • the interaction body includes a first terminal, a second terminal, a first authentication node, a second authentication node, a synchronization node, and an execution node , Including the following steps:
  • the first terminal sends an authentication request to the first authentication node.
  • the first authentication node When the first authentication node receives the authentication request of the first terminal, the first authentication node authenticates the first terminal to obtain the first security group to which the first terminal belongs.
  • the first authentication node obtains the security group association information of the first terminal according to the network address and the security group of the first terminal.
  • the first security group association information is used to indicate the mapping relationship between the network address and the security group to which the terminal belongs;
  • the first authentication node sends the first security group association information to the synchronization node.
  • the second terminal sends an authentication request to the second authentication node.
  • the second authentication node When the second authentication node receives the authentication request of the second terminal, the second authentication node authenticates the second terminal to obtain a second security group to which the second terminal belongs.
  • the second authentication node obtains second security group association information of the second terminal according to the terminal's network address and security group.
  • the second authentication node sends the second security group association information to the second synchronization node.
  • steps 1601 to 1604 are described first, and then the steps 1605 to 1608 are described only for convenience of expression. In this embodiment, the steps 1601 to 1604 and 1605 to 1608 are not sequenced. Limit. For example, step 1601 to step 1604 can be executed first, and then step 1605 to step 1608 can be executed; for example, step 1601 to step 1604 can be executed after step 1605 to step 1608, and then step 1601 to step 1604 can be executed; Steps 1601 to 1604 and steps 1605 to 1608 can be performed simultaneously.
  • performing steps 1601 to 1604 first, and then performing steps 1605 to 1608 may include: the execution time period of steps 1601 to 1604 is earlier than the execution time period of steps 1605 to 1608, or may include: step 1601 The execution time period to step 1604 overlaps with the execution time period of step 1605 to step 1608, and the execution time point of step 1604 is earlier than the execution time point of step 1605; similarly, steps 1601 to 1604 are executed thereafter.
  • Performing steps 1605 to 1608 first may include: the execution time period of steps 1601 to 1604 is later than the execution time period of steps 1605 to 1608, or may include: the execution time period of steps 1601 to 1604 and steps 1605 to The execution time of step 1608 overlaps, and the execution time of step 1601 is later than the execution time of step 1608.
  • the synchronization node receives the first security group association information of the first terminal sent by the first authentication node and the second security group association information of the second terminal sent by the second authentication node.
  • the synchronization node determines at least one execution node including the first target execution node, and the first target execution node is used to process the message of the terminal according to the security group policy.
  • the synchronization node sends the first security group association information of the first terminal and the second security group association information of the second terminal to at least one execution node.
  • the execution node receives the first security group association information of the first terminal and the second security group association information of the second terminal.
  • steps 1613 to 1615 the message processing flow when the first terminal accesses the second terminal is described, and through steps 1616 to 1618, the message processing flow when the second terminal accesses the first terminal is described. It should be noted that steps 1613 to 1615 are described first, and then steps 1616 to 1618 are described only for convenience of expression. In this embodiment, the two processes of steps 1613 to 1615 and 1616 to 1618 are not sequenced. Limit.
  • the first terminal sends the message to the execution node.
  • the first terminal may use the local network address as the source network address of the packet, and the second terminal network address as the destination network address of the packet, and generate a report to be sent to the second terminal based on the source network address and the destination network address Text to send the message to the execution node.
  • the first terminal may send a message to the authentication node, and the authentication node may receive the message sent by the first terminal and send the message to the execution node.
  • the execution node When the execution node receives the message of the first terminal, the execution node obtains the first security group corresponding to the source network address from the first security group association information according to the source network address carried in the packet of the first terminal, according to The destination network address carried in the message of the first terminal obtains the second security group corresponding to the destination network address from the second security group association information.
  • the execution node processes the message according to the security group policy that the source security group is the first security group and the destination security group is the second security group.
  • the second terminal sends the message to the execution node.
  • the second terminal may use the local network address as the source network address of the message, and the network address of the first terminal as the destination network address of the message, and generate a message to be sent to the first terminal based on the source network address and the destination network address Text to send the message to the execution node.
  • the second terminal may send a message to the authentication node, and the authentication node may receive the message sent by the second terminal and send the message to the execution node.
  • the execution node When the execution node receives the packet of the second terminal, the execution node obtains the second security group corresponding to the source network address from the second security group association information according to the source network address carried in the packet of the second terminal, according to The destination network address carried in the message of the second terminal obtains the first security group corresponding to the destination network address from the first security group association information.
  • the execution node processes the message according to the security group policy that the source security group is the second security group and the destination security group is the first security group.
  • the method provided in the embodiments of the present application may be applied to a scenario where terminals and network resources exchange visits.
  • terminals and network resources exchange visits For specific implementation, refer to the following embodiments in FIG. 17 to FIG. 19.
  • the authentication node in the embodiment of FIG. 17 is called a third authentication node, and the terminal authenticated by the third authentication node is called a third terminal, and the third terminal belongs to
  • the security group of is called the third security group
  • the security group to which the network resource belongs is called the fourth security group
  • the execution node that receives the message transmitted between the third terminal and the network resource is called the second target execution node.
  • FIG. 17 is a flowchart of an information synchronization method provided by an embodiment of the present application. As shown in FIG. 17, the method is executed by a synchronization node and includes the following steps:
  • the synchronization node receives the third security group association information of the third terminal sent by the third authentication node.
  • the third security group association information is used to indicate a mapping relationship between the network address of the third terminal and the third security group to which the third terminal belongs.
  • the third security group association information may include the network address of the third terminal and the group identification of the third security group.
  • the third security group association information may be generated during the authentication process of the third terminal by the third authentication node.
  • the process for the third authentication node to authenticate the third terminal may include: the third authentication node receives the authentication request of the third terminal, and the third authentication node authenticates the third terminal to obtain the third security group to which the third terminal belongs Obtain the third security group association information of the third terminal according to the network address of the third terminal and the third security group; send the third security group association information to the synchronization node.
  • the process reference may be made to the embodiment in FIG. 9 described above, and details are not described herein.
  • the synchronization node may receive the encoded third security group association information; decode the encoded third security group association information to obtain the third security group association information ;
  • the synchronization node may receive the compressed security group association information; decompress the compressed third security group association information to obtain the third security group association information.
  • the synchronization node determines at least one execution node including the second target execution node, and the second target execution node is configured to process the message transmitted between the third terminal and the network resource according to the security group policy.
  • the process of the synchronization node determining at least one execution node may include the following implementation manner 1 to implementation manner 2:
  • Implementation method 1 The synchronization node determines the second target execution node.
  • implementation one may include: the synchronization node obtains the second corresponding to the third target network segment from the correspondence between the network segment and the execution node according to the third target network segment to which the network address of the third terminal belongs Target execution node.
  • the third target network segment refers to the network segment to which the network address of the third terminal belongs.
  • Implementation method 2 Determine each execution node in the network.
  • the synchronization node may encode the third security group association information according to the structured data format to obtain the encoded third security group association information.
  • the synchronization node may compress the third security group association information to obtain the compressed third security group association information.
  • the synchronization node sends the third security group association information to at least one execution node.
  • Step 1704 may be the same as 903 in the embodiment of FIG. 9 described above, and details are not described herein.
  • the synchronization node may send the encoded third security group association information to at least one execution node.
  • the synchronization node may send the compressed third security group association information to at least one execution node.
  • the synchronization node synchronizes the third security group association information of the third terminal to the execution node, so that the execution node can hold the security group association information of the third terminal authenticated from the third authentication node, so that The execution node can sense the third security group to which the third terminal belongs, then when the execution node receives the packet transmitted between the third terminal and the network resource, it can match the third security group to which the third terminal and the network resource belong.
  • the security group policy processes the message, and can control the authority of mutual access between the third terminal and the network resource.
  • FIG. 18 is a flowchart of a message processing method provided by an embodiment of the present application. As shown in FIG. 18, the execution subject of the method may be an execution node, including the following steps:
  • the execution node receives the third security group association information of the third terminal sent by the synchronization node.
  • Step 1801 may be the same as 1201 in the embodiment of FIG. 12 described above, and details are not described here.
  • the execution node may receive the encoded third security group association information; decode the encoded third security group association information to obtain the third security group association information .
  • the execution node may receive the compressed third security group association information; decompress the compressed third security group association information to obtain the third security group association information.
  • the execution node receives the message transmitted between the third terminal and the network resource.
  • the message transmitted between the third terminal and the network resource may include at least one of a message sent by the third terminal to the network resource and a message sent by the network resource to the third terminal.
  • the source network address of the packet may be the network address of the third terminal, and the destination network address of the packet may be the network address of the network resource; accordingly, step 1802 may include :
  • the execution node receives the message sent by the third terminal and to be sent to the network resource.
  • Step 1802 may include: the execution node receives the message sent by the network resource and to be sent to the third terminal.
  • the execution node obtains the third security group corresponding to the network address of the third terminal from the third security group association information, and obtains the fourth security group corresponding to the network address of the network resource from the configuration information.
  • the execution node By executing step 1802, the execution node obtains the security group association information of the third terminal authenticated by the third authentication node.
  • the execution node can store configuration information in advance.
  • the execution node can control the mutual access authority between the third terminal and the network resource through the third terminal and the security group association information of the network resource.
  • the configuration information is used to indicate the security group to which the network resource belongs.
  • the configuration information may include a network address of at least one network resource and a group identifier of at least one security group.
  • the configuration information may be as shown in Table 6 below.
  • the execution node can query the configuration information of the network address of the network resource to obtain the security group corresponding to the network resource, that is, the fourth security group.
  • the configuration information can be generated by configuration instructions. For example, in the deployment phase, an administrator can trigger a configuration operation on an authorized node.
  • the authorized node can receive configuration instructions, generate configuration information according to the configuration instructions, and send the configuration information to the execution node.
  • the execution node may also send a query request to the authorized node to obtain configuration information from the authorized node. This embodiment does not limit the manner in which the execution node obtains configuration information.
  • Network address of network resources Group ID of the security group 202.178.100.1 100 202.178.100.2 200 202.178.100.3 300
  • step 1804 may include the following (1.1) and (1.2).
  • the third security group to which the third terminal belongs can be determined according to the network address of the third terminal and the third security group association information of the third terminal .
  • the destination network address is the network address of the network resource. Specifically, if the destination network address of the packet is the network address of the network resource, the fourth security group to which the network resource belongs can be determined according to the network address of the network resource and the configuration information.
  • step 1804 may include the following (2.1) and (2.2).
  • the fourth security group According to the source network address carried in the message, obtain the fourth security group corresponding to the source network address from the fourth security group association information. Specifically, if the source network address of the packet is the network address of the network resource, the fourth security group to which the network resource belongs can be determined according to the network address of the network resource and the configuration information.
  • the third security group to which the third terminal belongs can be determined according to the network address of the third terminal and the third security group association information of the third terminal .
  • the execution node processes the message according to a security group policy that matches the third security group of the third terminal and matches the fourth security group to which the network resource belongs.
  • the execution node may match the security groups policies corresponding to the third security group and the fourth security group according to the third security group to which the third terminal belongs and the fourth security group to which the network resource belongs.
  • the execution node may obtain the third security group from the correspondence between the security group and the security group policy according to the third security group to which the third terminal belongs and the fourth security group to which the network resource belongs And the security group policy corresponding to the fourth security group.
  • the correspondence between the security group and the security group policy please refer to 1204 in the embodiment of FIG. 12 above, which will not be repeated here.
  • the source security group is the third security group and the destination security group is the fourth security group.
  • the security group policy is called the third security group policy
  • the security group policy with the source security group as the fourth security group and the destination security group as the third security group is called the fourth security group policy.
  • the method of matching the security group policy may include: obtaining the third security group policy from the correspondence between the security group and the security group policy.
  • the method of matching the security group policy may include: obtaining the fourth security group policy from the correspondence between the security group and the security group policy. .
  • the third security group policy and the fourth security group policy may be different.
  • the processing method for the packet sent by the third terminal to the network resource and the processing method for the packet sent by the network resource to the third terminal may be different.
  • it may include any one or more of the following implementation (1) and implementation (2).
  • the access permission control strategy in the third security group policy can be different from the access permission control strategy in the fourth security group policy, so that the third terminal’s access to network resources is different from the network resource’s access to the third terminal
  • the function of, for example, may allow the third terminal to access the network resource and prohibit the network resource from accessing the third terminal.
  • the administrator's terminal may be allowed to access the elastic cloud server, and the elastic cloud server may be prohibited from accessing the administrator's terminal.
  • the experience assurance strategy in the third security group policy and the experience assurance strategy in the fourth security group policy can be different, so that the quality of service for the third terminal to access network resources is different from the quality of service for the network resources to access the third terminal For example, it can forward packets with high priority to the third terminal to access network resources, and low priority to forward packets with the third resource to access network resources.
  • the difference between the third security group policy and the fourth security group policy is only an optional method, and the third security group policy and the fourth security group policy may also be the same, which is not limited in this embodiment.
  • the execution node can hold the security group association information of the terminal authenticated from the authentication node by receiving the third security group association information of the third terminal sent by the synchronization node, so as to be able to perceive the security group to which the terminal belongs, Then when the execution node receives the message transmitted between the terminal and the network resource, it can process the message according to the security group policy that matches the security group to which the terminal belongs and the security group to which the network resource belongs, so that the terminal and the network resource Control the authority of mutual visits.
  • FIG. 19 is a flowchart of a service processing method provided by an embodiment of the present application.
  • the interaction body includes an authentication node, a third terminal, a synchronization node, and an execution node, including the following steps:
  • the third terminal sends an authentication request to the third authentication node.
  • the third authentication node When the third authentication node receives the authentication request of the third terminal, the third authentication node authenticates the third terminal to obtain a third security group to which the third terminal belongs.
  • the third authentication node obtains the third security group association information of the third terminal according to the network address of the third terminal and the third security group.
  • the third authentication node sends the third security group association information to the synchronization node.
  • the synchronization node determines at least one execution node including the target execution node, and the target execution node is used to process the terminal according to the third security group policy Message.
  • the synchronization node sends the third security group association information to at least one execution node.
  • the execution node receives the third security group association information of the third terminal sent by the synchronization node.
  • the third terminal sends the message transmitted between the third terminal and the network resource to the execution node.
  • the execution node When the execution node receives the message transmitted between the third terminal and the network resource, the execution node obtains the third security group corresponding to the network address from the third security group association information according to the network address carried in the packet.
  • the execution node processes the message according to the third security group policy that matches the third security group and matches the fourth security group to which the network resource belongs.
  • the method provided in the embodiment of the present application may be applied in a scenario where an authorized device supports a target function, the target function is a function of sending security group association information to a synchronization node, and the specific implementation may be as shown in the following embodiment of FIG. 20 .
  • FIG. 20 is a flowchart of a service processing method provided by an embodiment of the present application.
  • the interaction body of the method includes a first authorization device, a terminal, a synchronization node, and an execution node, including the following steps:
  • the terminal sends an authentication request to the first authorized device.
  • the first authorized device is an authorized device that supports the target function.
  • the first authorized device may support sending the security group association information to the authentication node, and also support sending the security group association information to other devices than the authentication node.
  • the first authorized device may be a self-developed device.
  • the first authorized device may be a self-developed AAA server.
  • the first authorization device When the first authorization device receives the authentication request of the terminal, the first authorization device authenticates the terminal to obtain the security group to which the terminal belongs.
  • Step 2002 is the same as steps 901 to 902 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • the first authorized device obtains the security group association information of the terminal according to the terminal's network address and security group.
  • Step 2003 is the same as step 903 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • the first authorized device may encode the security group association information according to the structured data format to obtain the encoded security group association information.
  • the first authorized device may compress the security group association information to obtain the compressed security group association information.
  • the first authorized device sends the security group association information to the synchronization node.
  • Step 2004 is the same as step 904 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • this step may include: the first authorized device sends the encoded security group association information to the synchronization node .
  • this step may include: the first authorized device sends the compressed security group association information to the synchronization node.
  • the synchronization node receives the security group association information of the terminal sent by the first authorized device.
  • Step 2005 may be the same as 1001 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • the synchronization node determines at least one execution node including the target execution node.
  • the target execution node is used to process the message of the terminal according to the security group policy.
  • Step 2006 can be the same as steps 1001 to 1002 in the above-described embodiment of FIG. 10, and details are not repeated here.
  • the synchronization node sends the security group association information to at least one execution node.
  • Step 2007 may be the same as 1003 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • the execution node receives the security group association information of the terminal sent by the synchronization node.
  • Step 2008 may be the same as 1201 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the terminal sends the message to the execution node.
  • the execution node when the execution node receives the message from the terminal, the execution node obtains the security group corresponding to the network address from the security group association information according to the network address carried in the message.
  • Step 2010 may be the same as 1202 to 1203 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the execution node processes the message according to the security group policy matched by the security group.
  • Step 2011 may be the same as 1204 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the method provided in the embodiment of the present application may also be applied to a scenario where the authorized device does not support the target function, and the specific implementation may be as shown in the embodiment of FIG. 21 described below.
  • FIG. 21 is a flowchart of a business processing method provided by an embodiment of the present application.
  • the interaction body of the method includes an authentication point device, a second authorization device, a terminal, a synchronization node, and an execution node, including the following steps :
  • the terminal sends an authentication request to the second authorized device.
  • the second authorized device is an authorized device that does not support the target function.
  • the second authorized device may be a third-party device.
  • the second authorization device may be a third-party AAA server.
  • the second authorization device When the second authorization device receives the authentication request of the terminal, the second authorization device authenticates the terminal to obtain the security group to which the terminal belongs.
  • Step 2102 is the same as steps 901 to 902 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • the second authorization device obtains the security group association information of the terminal according to the terminal's network address and security group.
  • Step 2103 is the same as step 903 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • the second authorized device may encode the security group association information according to the structured data format.
  • the second authorized device may compress the security group association information.
  • the second authorized device sends the security group association information to the authentication point device.
  • Step 2104 is the same as step 904 in the embodiment of FIG. 9 described above, and details are not repeated here.
  • this step may include: the second authorized device sends the encoded security group association information to the authentication point device.
  • this step may include: the second authorized device sends the compressed security group association information to the authentication point device.
  • the authentication point device receives security group association information.
  • Step 2105 can be the same as 1001 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • the authentication point device sends the security group association information to the synchronization node.
  • Step 2106 can be the same as 1002 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • this step may include: the authentication point device sends the encoded security group association information to the synchronization node.
  • this step may include: the authentication point device sends the compressed security group association information to the synchronization node.
  • the synchronization node receives the security group association information of the terminal sent by the authentication point device.
  • Step 2107 can be the same as 1001 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • the synchronization node determines at least one execution node including the target execution node, and the target execution node is used to process the terminal's message according to the security group policy.
  • Step 2108 can be the same as 1002 in the above-mentioned embodiment of FIG. 10, and details are not repeated here.
  • the synchronization node sends the security group association information to at least one execution node.
  • the terminal sends the message to the execution node.
  • the execution node When the execution node receives the message from the terminal, the execution node obtains the security group corresponding to the network address from the security group association information according to the network address carried in the message.
  • Step 2110 can be the same as 1202 to 1203 in the embodiment of FIG. 12 described above, and details will not be repeated here.
  • the execution node processes the message according to the security group policy matched by the security group.
  • Step 2111 can be the same as 1204 in the embodiment of FIG. 12 described above, and details are not repeated here.
  • the second authorized device sends the security group association information to the authentication point device, and the authentication point device reports the security group association information to the synchronization node, and the synchronization node sends the security group association information to the execution node.
  • the synchronization of the security group association information can be achieved, which can break the technical barrier that third-party devices usually do not support the distribution of security group association information to other network devices other than the authentication point device, thereby achieving support and The function of docking third-party devices to improve network compatibility.
  • the information synchronization device includes:
  • the receiving module 2201 is configured to execute any one or more of the above steps 1001, 1401, 1402, 1701, 2005, and 2105;
  • the determining module 2202 is configured to perform any one or more of the above steps 1002, step 1305, step 1403, step 1610, step 1702, step 1905, step 2006, and step 2107;
  • the sending module 2203 is configured to perform any one or more of the above step 1003, step 1306, step 1404, step 1703, step 1906, step 2007, and step 2108.
  • the determination module 2202 is configured to perform any one or more of the implementation manner 1 and the implementation manner 2 in the above step 1002.
  • the receiving module 2201 is also used to receive configuration instructions.
  • each module in the embodiment of FIG. 22 may specifically be a software module that performs corresponding functions in software, that is, a “module” may be a functional module composed of a set of computer programs, and the computer program may be a source Program or target program, the computer program can be realized by any programming language.
  • the computer device can realize the function of information synchronization based on the hardware of the processor and the memory, that is, the software code stored in the memory of the computer device can be executed by the processor of the computer device to execute the corresponding Software to achieve the function of information synchronization.
  • the information synchronization device provided in the embodiment of FIG. 22 only uses the division of the above functional modules as an example for illustration. In practical applications, the above functions can be allocated by different functions as needed Module completion means that the internal structure of the information synchronization device is divided into different functional modules to complete all or part of the functions described above.
  • the information synchronization apparatus and the information synchronization method embodiment provided in the above embodiments belong to the same concept. For the specific implementation process, see the method embodiments, and details are not described here.
  • the message processing device includes:
  • the receiving module 2301 is configured to perform any one or more of step 1201, step 1202, step 1307, step 1501, step 1502, step 1612, step 1503, step 1801, step 1802, step 1907, and step 2008;
  • the obtaining module 2302 is configured to perform any one or more of step 1203, step 1309, step 1504, step 1614, step 1803, step 1909, and step 2010;
  • the processing module 2303 is configured to perform any one or more of step 1204, step 1310, step 1505, step 1615, step 1617, step 1618, step 1804, step 1910, and step 2011.
  • each module in the embodiment of FIG. 23 may specifically be a software module that performs corresponding functions in software, that is, a “module” may be a functional module composed of a group of computer programs, and the computer program may be a source Program or target program, the computer program can be realized by any programming language.
  • the computer device can implement the message processing function based on the hardware of the processor and the memory, that is, the software code stored in the memory of the computer device can be executed by the processor of the computer device to execute the corresponding Software to achieve the function of message processing.
  • the second point that needs to be explained is: when the message processing device provided in the embodiment of FIG. 23 processes a message, only the above-mentioned division of each functional module is used as an example for illustration. In practical applications, the above-mentioned functions can be assigned differently according to needs. Is completed, that is, the internal structure of the message processing device is divided into different functional modules to complete all or part of the functions described above. In addition, the message processing apparatus and message processing method embodiments provided in the above embodiments belong to the same concept. For the specific implementation process, see the method embodiments, and details are not described here.
  • the authentication device includes:
  • the receiving module 2401 is configured to execute any one or more of step 901, step 1701, and step 2105;
  • the authentication module 2402 is configured to perform any one or more of step 902, step 1302, step 1602, step 1602, step 1902, step 2002, and step 2102;
  • the obtaining module 2403 is configured to perform any one or more of step 903, step 1303, step 1603, step 1605, step 1903, step 2003, and step 2103;
  • the sending module 2404 is configured to perform any one or more of step 904, step 1304, step 1604, step 1607, step 1904, step 2004, step 2104, and step 2106.
  • each module in the embodiment of FIG. 24 may specifically be a software module that executes a corresponding function in software, that is, a “module” may be a functional module composed of a group of computer programs, and the computer program may be a source Program or target program, the computer program can be realized by any programming language.
  • the computer device can realize the authentication function based on the hardware of the processor and the memory, that is, the software code stored in the memory of the computer device can be executed by the processor of the computer device to execute the corresponding software To achieve the authentication function.
  • the second point that needs to be explained is: when the authentication device provided in the embodiment of FIG. 24 performs authentication, only the above-mentioned division of each functional module is used as an example for illustration. In practical applications, the above-mentioned functions can be allocated by different functional modules as needed Completed, that is, the internal structure of the authentication device is divided into different functional modules to complete all or part of the functions described above. In addition, the authentication device and the authentication method embodiment provided in the above embodiments belong to the same concept. For the specific implementation process, see the method embodiment, and details are not described here.
  • the present application also provides a computer program product containing instructions that, when run on a computer device, enable the computer device to implement the operations performed by the information synchronization method in the foregoing embodiments.
  • the present application also provides a computer program product containing instructions that, when run on a computer device, enable the computer device to implement the operations performed by the message processing method in the foregoing embodiments.
  • the present application also provides a computer program product containing instructions that, when run on a computer device, enable the computer device to implement the operations performed by the authentication method in the foregoing embodiments.
  • the present application also provides a business processing system.
  • the system includes: the information synchronization device in the foregoing FIG. 22 embodiment and the report in the FIG. 23 embodiment The document processing device and the authentication device in the embodiment of FIG. 24.
  • the system includes:
  • the present application also provides a chip, which includes a processor and/or program instructions, and when the chip is running, implements the operations performed by the information synchronization method in the foregoing embodiments.
  • the present application further provides a chip, which includes a processor and/or program instructions, and when the chip is running, implements the operations performed by the message processing method in the foregoing embodiments.
  • the present application further provides a chip, which includes a processor and/or program instructions, and when the chip is running, implements the operations performed by the authentication method in the foregoing embodiments.
  • the computer program product includes one or more computer program instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • the computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program instructions can be passed from a website site, computer, server or data center Wired or wireless transmission to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device that includes one or more available medium integrated servers, data centers, and the like.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (DVD)), or a semiconductor medium (for example, a solid-state hard disk).
  • plurality in this application means two or more, for example, multiple data packets refer to two or more data packets.
  • first and second are used to distinguish the same or similar items whose functions and functions are basically the same. Those skilled in the art can understand that the words “first” and “second” are not correct And the order of execution.
  • the program may be stored in a computer-readable storage medium.
  • the storage medium can be read-only memory, magnetic disk or optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种信息同步方法、认证方法及装置，属于网络技术领域。本申请通过将安全组关联信息从认证节点同步至执行节点上，可以让执行节点得到终端的安全组关联信息，则执行节点根据安全组关联信息，即可感知到终端所属的安全组，从而能够按照安全组策略对终端的报文进行处理，可以实现认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。

Description

信息同步方法、认证方法及装置
本申请要求于2018年12月4日提交中国国家知识产权局、申请号为201811476240.3、发明名称为“信息同步方法、认证方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，特别涉及一种信息同步方法、认证方法及装置。
背景技术
随着无线网络的建设和推广以及远程接入技术的成熟应用，无线网络的边界正在消失，无线网络终端的接入位置经常出现大范围的移动。为了保证终端的业务得到正常处理，可以通过实施业务随行技术，来保证无论终端从什么地点接入，该终端的接入权限都是一致的。在业务随行技术中，各个节点设备按照其功能的不同，至少可以分为认证节点以及执行节点。当终端发起认证时，由认证节点对终端进行认证，以确定终端所属的安全组；当终端发送报文时，由执行节点确定终端所属的安全组匹配的安全组策略，按照安全组策略处理报文。其中，为了让执行节点感知终端所属的安全组，需要将认证节点确定出的安全组同步给执行节点。
目前，通常采用内联安全组标签(英文：inline security group tag，简称inline SGT)技术,将认证节点确定的安全组同步给执行节点。具体地，当认证节点对终端认证通过时，会存储终端所属的安全组；当认证节点接收到终端的报文时，认证节点会根据该终端所属的安全组，生成安全组标签，该安全组标签用于标识终端所属的安全组；认证节点会在报文的头部插入安全组标签，从而通过对报文进行扩展，让报文携带安全组标签；认证节点会将携带了安全组标签的报文发送给执行节点；执行节点接收到携带了安全组标签的报文时，会解析该安全组标签，以确定终端所属的安全组，按照安全组策略处理报文。
采用上述方法进行信息同步时，需要对终端的报文进行私有扩展，而很多节点设备并不支持对报文私有扩展的功能，导致无法实施该方法来进行信息同步，可见该方法兼容性较差，应用范围狭窄。
发明内容
本申请实施例提供了一种信息同步方法、认证方法及装置，能够解决相关技术中兼容性较差的技术问题。所述技术方案如下：
第一方面，提供了一种信息同步方法，所述方法包括：
接收认证节点发送的终端的安全组关联信息，所述安全组关联信息用于指示所述终端的网络地址与所述终端所属的安全组之间的映射关系；
确定包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文；
将所述安全组关联信息发送至所述至少一个执行节点。
本实施例提供的方法，达到的效果至少可以包括：同步节点通过将安全组关联信息从认证节点同步至执行节点上，可以让执行节点得到终端的安全组关联信息，则执行节点根据安全组关联信息，即可感 知到终端所属的安全组，从而能够按照安全组策略对终端的报文进行处理，可以实现认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
可选地，所述确定包括目标执行节点的至少一个执行节点，包括：
根据所述网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定所述目标网段对应的所述目标执行节点；
通过这种可选方式，达到的效果至少可以包括：当同步节点接收到不同网段的终端的安全组信息时，可以将各个安全组信息分别发送至对应网段的执行节点，可以实现每个执行节点接收本端网段的终端的安全组信息的功能，达到精细化推送的效果，可以避免执行节点由于频繁接收安全组信息，对运行资源的消耗。同时，可以节约执行节点的存储资源，避免单个执行节点待存储的安全组关联信息的数据量过大。尤其是，在接入网络的终端数量庞大的场景中，同步节点待同步的安全组信息数据量庞大，而通过精细化的发送安全组信息，可以提高整个系统的运行效率。
可选地，所述确定包括目标执行节点的至少一个执行节点，包括：
确定网络中的每个执行节点。
可选地，所述根据所述网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定所述目标网段对应的所述目标执行节点之前，所述方法还包括：
接收配置指令，所述配置指令用于指示网段与执行节点之间的对应关系。
通过这种可选方式，达到的效果至少可以包括：可以支持安全组订阅配置的功能，满足用户的自定义需求。
可选地，所述接收认证节点发送的终端的安全组关联信息，包括：
接收第一认证节点发送的第一终端的第一安全组关联信息，所述第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的第一安全组之间的映射关系；
接收第二认证节点发送的第二终端的第二安全组关联信息，所述第二认证节点与所述第一认证节点不同，所述第二安全组关联信息用于指示所述第二终端的网络地址与所述第二终端所属的第二安全组之间的映射关系；
相应地，所述确定包括目标执行节点的至少一个执行节点，包括：
确定包括第一目标执行节点的至少一个执行节点，所述第一目标执行节点用于按照安全组策略处理所述第一终端与所述第二终端之间传输的报文。
可选地，所述接收所述认证节点发送的所述终端的安全组关联信息，包括：
接收第三认证节点发送的第三终端的第三安全组关联信息，所述第三安全组关联信息用于指示所述第三终端的网络地址与所述第三终端所属的第三安全组之间的映射关系；
相应地，所述确定包括目标执行节点的至少一个执行节点，包括：
确定包括第二目标执行节点的至少一个执行节点，所述第二目标执行节点用于按照安全组策略处理所述第三终端与网络资源之间传输的报文。
可选地，所述接收认证节点发送的终端的安全组关联信息，包括：
接收授权设备发送的终端的安全组关联信息；或者，
接收认证点设备发送的终端的安全组关联信息，所述终端的安全组关联信息由授权设备发送至所述认证点设备。
可选地，所述接收授权设备发送的终端的安全组关联信息，包括：
接收第一授权设备发送的终端的安全组关联信息，所述第一授权设备为支持目标功能的授权设备，所述目标功能为将安全组关联信息发送至同步节点的功能。
可选地，所述终端的安全组关联信息由授权设备发送至所述认证点设备，包括：
所述终端的安全组信息由第二授权设备发送至所述认证点设备，所述第二授权设备为不支持目标功能的授权设备。
可选地，所述方法还包括：
接收所述认证节点发送的所述终端的更新后的安全组关联信息；
将所述更新后的安全组关联信息发送至所述至少一个执行节点；
其中，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述终端所属的更新后的安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述终端所属的更新后的安全组之间的映射关系。
通过这种可选方式，达到的效果至少可以包括:如果终端的当前位置发生变化，则终端的网络地址或安全组可以发生更新，使得认证节点能够随着终端的当前位置的更新，更新安全组关联信息，并将更新后的安全组关联信息上报该同步节点，使得同步节点能够得到更新后的终端的安全组关联信息，保证同步节点存储的终端的安全组关联信息的准确性。
可选地，所述将所述安全组关联信息发送至所述目标执行节点之前，所述方法还包括：
按照结构化数据格式，对所述安全组关联信息进行编码；
相应地，所述将所述安全组关联信息发送至所述目标执行节点，包括：
将编码后的安全组关联信息发送至所述目标执行节点。
可选地，所述结构化数据格式为协议缓存protocol buffer格式；
可选地，所述将所述安全组关联信息发送至所述目标执行节点之前，所述方法还包括：
对所述安全组关联信息进行压缩；
相应地，所述将所述安全组关联信息发送至所述目标执行节点，包括：
将压缩后的安全组关联信息发送至所述目标执行节点。
可选地，所述接收所述认证节点发送的所述终端的安全组关联信息，包括：
接收编码后的安全组关联信息；
所述方法还包括：
对所述编码后的安全组关联信息进行解码，得到所述安全组关联信息；
可选地，所述接收所述认证节点发送的所述终端的安全组关联信息，包括：
接收压缩后的安全组关联信息；
所述方法还包括：
对所述压缩后的安全组关联信息进行解压缩，得到所述安全组关联信息。
可选地，所述接收认证节点的安全组关联信息，包括：
通过第一网络连接，接收认证节点的安全组关联信息，所述第一网络连接属于长连接以及加密通道中的至少一种。
可选地，所述接收认证节点的安全组关联信息之前，所述方法还包括：
接收所述认证节点的第一网络连接请求，所述第一网络连接请求用于请求建立所述第一网络连接；
向所述认证节点发送第一网络连接响应，所述第一网络连接响应用于确认建立所述第一网络连接。
通过上述方式以建立第一网络连接的过程达到的效果至少可以包括：第一网络连接可以为双向连接，即，任一个认证节点和同步节点之间进行数据传输时，认证节点和同步节点同客户端和服务端的模式，只需配置一条网络连接即可，极大地减少了配置操作的工作量，并且进少了维护网络连接带来的后 期运维的工作量。尤其是，在认证节点数量较多的场景，也只需要在认证节点和同步节点之间配置连接，不会形成网状拓扑(英文：full-mesh)的连接配置，减少了部署和维护工作量。
可选地，所述向所述目标执行节点发送所述安全组关联信息，包括：
通过第二网络连接，向所述目标执行节点发送所述安全组关联信息，所述第二网络连接属于长连接以及加密通道中的至少一种。
可选地，所述接收认证节点的安全组关联信息之前，所述方法还包括：
接收所述认证节点的第二网络连接请求，所述第二网络连接请求用于请求建立所述第二网络连接；
向所述认证节点发送第二网络连接响应，所述第二网络连接响应用于确认建立所述第二网络连接。
通过上述方式建立第二网络连接，达到的效果至少可以包括：第二网络连接可以为双向连接，即，同步节点和任一个执行节点之间进行数据传输时，同步节点和认证节点通过客户端和服务端的模式，只需配置一条网络连接即可，极大地减少了配置操作的工作量，并且进少了维护网络连接带来的后期运维的工作量。尤其是，在执行节点数量较多的场景，也只需要在执行节点和同步节点之间配置连接，不会形成网状拓扑(英文：full-mesh)的连接配置，减少了部署和维护工作量。
可选地，所述方法还包括：
接收所述第一认证节点发送的所述第一终端的更新后的第一安全组关联信息；
将所述更新后的第一安全组关联信息发送至所述至少一个执行节点；
其中，所述更新后的第一安全组关联信息用于指示所述第一终端的更新后的网络地址与所述第一安全组之间的映射关系，或者，所述更新后的第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的更新后的第一安全组之间的映射关系，或者，所述更新后的第一安全组关联信息用于指示所述第一终端的更新后的网络地址与所述第一终端所属的更新后的第一安全组之间的映射关系。
可选地，所述方法还包括：
接收所述第二认证节点发送的所述第二终端的更新后的第二安全组关联信息；
将所述更新后的第二安全组关联信息发送至所述至少一个执行节点；
其中，所述更新后的第二安全组关联信息用于指示所述第二终端的更新后的网络地址与所述第二安全组之间的映射关系，或者，所述更新后的第二安全组关联信息用于指示所述第二终端的网络地址与所述第二终端所属的更新后的第二安全组之间的映射关系，或者，所述更新后的第二安全组关联信息用于指示所述第二终端的更新后的网络地址与所述第二终端所属的更新后的第二安全组之间的映射关系。
第二方面，提供了一种报文处理方法，所述方法包括：
接收同步节点发送的终端的安全组关联信息，所述同步节点用于将所述安全组关联信息从认证节点同步至执行节点，所述安全组关联信息用于指示所述终端的网络地址与所述终端所属的安全组之间的映射关系；
接收所述终端的报文；
根据所述报文携带的所述网络地址，从所述安全组关联信息中，获取所述网络地址对应的所述安全组；
按照所述安全组匹配的安全组策略，处理所述报文。
本实施例提供的方法，达到的效果至少可以包括：执行节点可以通过同步节点下发的安全组关联信息，得到终端的安全组关联信息，从而能够感知终端所属的安全组，当终端的流量到达执行节点时，执行节点可以按照安全组策略对终端的报文进行处理，实现了认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
可选地，所述接收同步节点发送的终端的安全组关联信息，包括：
接收所述同步节点发送的所述第一终端的第一安全组关联信息，所述同步节点用于将所述第一安全组关联信息从第一认证节点同步至所述执行节点，所述第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的第一安全组之间的映射关系；
接收所述同步节点发送的所述第二终端的第二安全组关联信息，所述同步节点用于将所述第二安全组关联信息从第二认证节点同步至所述执行节点，所述第二认证节点与所述第一认证节点不同，所述第二安全组关联信息用于指示所述第二终端的网络地址与所述第二终端所属的第二安全组之间的映射关系；
相应地，所述接收所述终端的报文，包括：
接收所述第一终端与所述第二终端之间传输的报文；
所述按照所述安全组匹配的安全组策略，处理所述报文，包括：
按照与所述第一安全组匹配、且与所述第二安全组匹配的安全组策略，处理所述报文。
可选地，所述根据所述报文携带的所述网络地址，从所述安全组关联信息中，获取所述网络地址对应的所述安全组，包括：
根据所述报文携带的源网络地址，从所述第一安全组关联信息中，获取所述源网络地址对应的所述第一安全组，所述源网络地址为所述第一终端的网络地址；
根据所述报文携带的目的网络地址，从所述第二安全组关联信息，获取所述目的网络地址对应的所述第二安全组，所述目的网络地址为所述第二终端的网络地址。
可选地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
接收所述同步节点发送的第三终端的第三安全组关联信息，所述第三安全组关联信息用于指示所述第三终端的网络地址与所述第三终端所属的第三安全组之间的映射关系；
所述接收所述终端的报文，包括：
接收所述第三终端与网络资源之间传输的报文；
相应地，所述按照所述安全组匹配的安全组策略，处理所述报文，包括：
按照与所述第三安全组匹配、且与所述网络资源所属的第四安全组匹配的安全组策略，处理所述报文。
可选地，所述方法还包括：
接收所述同步节点发送的所述终端的更新后的安全组关联信息；
基于所述终端的更新后的安全组关联信息，执行获取安全组以及处理报文的步骤；
其中，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述终端所属的更新后的安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述终端所属的更新后的安全组之间的映射关系。
可选地，所述接收同步节点发送的所述终端的安全组关联信息之前，所述方法还包括：
建立与所述同步节点之间的第二网络连接，所述第二网络连接属于长连接、加密通道、连接复用中的至少一种；
相应地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
通过所述第二网络连接，接收同步节点发送的所述终端的安全组关联信息。
可选地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
接收同步节点发送的所述终端的编码后的安全组关联信息；
所述方法还包括：
对所述编码后的安全组关联信息进行解码，得到安全组关联信息。
可选地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
接收压缩后的安全组关联信息；
所述方法还包括：
对所述压缩后的安全组关联信息进行解压缩，得到所述安全组关联信息。
可选地，所述方法还包括：
接收所述同步节点发送的所述第一终端的更新后的第一安全组关联信息；
基于所述第一终端的更新后的第一安全组关联信息，执行获取第一安全组以及处理报文的步骤；
其中，所述更新后的第一安全组关联信息用于指示所述第一终端的更新后的网络地址与所述第一安全组之间的映射关系，或者，所述更新后的第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的更新后的第一安全组之间的映射关系，或者，所述更新后的第一安全组关联信息用于指示所述第一终端的更新后的网络地址与所述第一终端所属的更新后的第一安全组之间的映射关系。
可选地，所述方法还包括：
接收所述同步节点发送的所述第二终端的更新后的第二安全组关联信息；
基于所述第二终端的更新后的第二安全组关联信息，执行获取第二安全组以及处理报文的步骤；
其中，所述更新后的第二安全组关联信息用于指示所述第二终端的更新后的网络地址与所述第二安全组之间的映射关系，或者，所述更新后的第二安全组关联信息用于指示所述第二终端的网络地址与所述第二终端所属的更新后的第二安全组之间的映射关系，或者，所述更新后的第二安全组关联信息用于指示所述第二终端的更新后的网络地址与所述第二终端所属的更新后的第二安全组之间的映射关系。
第三方面，提供了一种认证方法，所述方法包括：
接收终端的认证请求；
对所述终端进行认证，得到所述终端所属的安全组；
根据所述终端的网络地址以及所述安全组，获取所述终端的安全组关联信息，所述安全组关联信息用于指示所述网络地址与所述终端所属的安全组之间的映射关系；
将所述安全组关联信息发送至同步节点，所述同步节点用于将所述安全组关联信息同步至包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文。
本实施例提供的方法，达到的效果至少可以包括：认证节点通过根据终端的网络地址以及安全组，获取终端的安全组关联信息，将安全组关联信息发送至同步节点，能够让同步节点将终端的安全组关联信息同步至执行节点，以便执行节点可以得到终端的安全组关联信息，则执行节点根据安全组关联信息，即可感知到终端所属的安全组，从而能够按照安全组策略对终端的报文进行处理，可以实现认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
可选地，所述将所述安全组关联信息发送至同步节点，包括：
将所述安全组关联信息发送至认证点设备，所述安全组关联信息用于供所述认证点设备用于发送至所述同步节点。
可选地，所述方法还包括：
获取所述终端的更新后的网络地址；
根据所述更新后的网络地址以及所述安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述安全组之间的映射关系；
将所述终端的更新后的安全组关联信息发送至所述同步节点。
可选地，所述方法还包括：
获取所述终端所属的更新后的安全组；
根据所述网络地址以及所述终端所属的更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述终端所属的更新后的安全组之间的映射关系；
将所述终端的更新后的安全组关联信息发送至所述同步节点。
可选地，所述方法还包括：
获取所述终端的更新后的网络地址以及所述终端所属的更新后的安全组；
根据所述终端的更新后的网络地址以及所述终端所属的更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述终端所属的更新后的安全组之间的映射关系；
将所述终端的更新后的安全组关联信息发送至所述同步节点。
可选地，所述方法应用于授权设备以及认证点设备中的至少一项。
可选地，所述授权设备为认证授权付费AAA服务器；
可选地，所述方法应用于第二授权设备，所述第二授权设备为不支持目标功能的授权设备，所述目标功能为将安全组关联信息发送至同步节点的功能。
可选地，所述方法应用于第一授权设备，所述第一授权设备为支持目标功能的授权设备。
可选地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
接收同步节点发送的所述终端的编码后的安全组关联信息；
所述方法还包括：
对所述编码后的安全组关联信息进行解码，得到安全组关联信息。
可选地，所述接收同步节点发送的所述终端的安全组关联信息，包括：
接收压缩后的安全组关联信息；
所述方法还包括：
对所述压缩后的安全组关联信息进行解压缩，得到所述安全组关联信息。
可选地，所述将所述安全组关联信息发送至同步节点之前，所述方法还包括：
建立与所述同步节点之间的第一网络连接，所述第一网络连接属于长连接、加密通道、连接复用中的至少一种；
相应地，所述将所述安全组关联信息发送至同步节点，包括：
通过所述第一网络连接，将所述安全组关联信息发送至所述同步节点。
第四方面，提供了一种信息同步装置，所述装置用于执行上述信息同步方法。具体地，该信息同步置包括用于执行上述第一方面或第一方面的任一种可选方式所述的信息同步方法的功能模块。
第五方面，提供了一种报文处理装置，所述装置用于执行上述报文处理方法。具体地，该报文处理装置包括用于执行上述第二方面或第二方面的任一种可选方式所述的报文处理方法的功能模块。
第六方面，提供了一种认证装置，所述装置用于执行上述认证方法。具体地，该认证装置包括用于执行上述第三方面或第三方面的任一种可选方式所述的认证方法的功能模块。
第七方面，提供了一种计算机设备，所述计算机设备包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第一方面或第一方面的任一种可选方式所述的信息同步方法所执行的操作。
第八方面，提供一种计算机设备，所述计算机设备包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第二方面或第二方面的任一种可选方式所述的 报文处理方法所执行的操作。
第九方面，提供一种计算机设备，所述计算机设备包括处理器和存储器，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第三方面或第三方面的任一种可选方式所述的认证方法所执行的操作。
第十方面，提供一种计算机可读存储介质，所述存储介质中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第一方面或第一方面的任一种可选方式所述的信息同步方法所执行的操作。
第十一方面，提供一种计算机可读存储介质，所述存储介质中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第二方面或第二方面的任一种可选方式所述的报文处理方法所执行的操作。
第十二方面，提供一种计算机可读存储介质，所述存储介质中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第三方面或第三方面的任一种可选方式所述的认证方法所执行的操作。
第十三方面，提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得该计算机设备能够实现上述第一方面或第一方面的任一种可选方式所述的信息同步方法所执行的操作。
第十四方面，提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得该计算机设备能够实现上述第二方面或第二方面的任一种可选方式所述的报文处理方法所执行的操作。
第十五方面，提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得该计算机设备能够实现上述第三方面或第三方面的任一种可选方式所述的认证方法所执行的操作。
第十六方面，提供了一种计算机设备集群，包括至少一个计算机设备，每个计算机设备包括处理器和存储器，所述至少一个计算机设备的处理器用于执行以实现上述第一方面或第一方面的任一种可选方式所述的信息同步方法所执行的操作。
第十七方面，提供了一种计算机设备集群，包括至少一个计算机设备，每个计算机设备包括处理器和存储器，所述至少一个计算机设备的处理器用于执行以实现上述第二方面或第二方面的任一种可选方式所述的报文处理方法所执行的操作。
第十八方面，提供了一种计算机设备集群，包括至少一个计算机设备，每个计算机设备包括处理器和存储器，所述至少一个计算机设备的处理器用于执行以实现上述第三方面或第三方面的任一种可选方式所述的认证方法所执行的操作。
第十九方面，提供一种业务处理系统，在一种可能的实现方式中，所述系统包括：第四方面所述的信息同步装置、第五方面所述的报文处理装置和第六方面所述的认证装置。
在另一种可能的实现方式中，所述系统包括：第七方面所述的计算机设备、第八方面所述的计算机设备和第九方面所述的计算机设备。
在另一种可能的实现方式中，所述系统包括：第十六方面所述的计算机设备、第十七方面所述的计算机设备和第十八方面所述的计算机设备。
第二十方面，提供了一种芯片，所述芯片包括处理器和/或程序指令，当所述芯片运行时，实现上述第一方面或第一方面的任一种可选方式所述的信息同步方法所执行的操作。
第二十一方面，提供了一种芯片，所述芯片包括处理器和/或程序指令，当所述芯片运行时，实现上述第二方面或第二方面的任一种可选方式所述的报文处理方法所执行的操作。
第二十二方面，提供了一种芯片，所述芯片包括处理器和/或程序指令，当所述芯片运行时，实现上述第三方面或第三方面的任一种可选方式所述的认证方法所执行的操作。
附图说明
图1是本申请实施例提供的一种实施环境的架构图；
图2是本申请实施例提供的另一种实施环境的架构图；
图3是本申请实施例提供的另一种实施环境的架构图；
图4是本申请实施例提供的另一种实施环境的架构图；
图5是本申请实施例提供的另一种实施环境的架构图；
图6是本申请实施例提供的一种计算机设备的结构示意图；
图7是本申请实施例提供的一种计算机设备集群的系统架构图；
图8是本申请实施例提供的另一种计算机设备集群的系统架构图；
图9是本申请实施例提供的一种认证方法的流程图；
图10是本申请实施例提供的一种信息同步方法的流程图；
图11是本申请实施例提供的一种信息同步方法的示意图；
图12是本申请实施例提供的一种报文处理方法的流程图；
图13是本申请实施例提供的一种业务处理方法的流程图；
图14是本申请实施例提供的一种信息同步方法的示意图；
图15是本申请实施例提供的一种报文处理方法的流程图；
图16是本申请实施例提供的一种业务处理方法的流程图；
图17是本申请实施例提供的一种信息同步方法的示意图；
图18是本申请实施例提供的一种报文处理方法的流程图；
图19是本申请实施例提供的一种业务处理方法的流程图；
图20是本申请实施例提供的一种业务处理方法的流程图；
图21是本申请实施例提供的一种业务处理方法的流程图；
图22是本申请实施例提供的一种信息同步装置的结构示意图；
图23是本申请实施例提供的一种报文处理装置的结构示意图；
图24是本申请实施例提供的一种认证装置的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
以下对本申请涉及的术语进行解释。
安全组：是指通过组的形式来描述或组织的一个或多个终端和/或一个或多个网络资源。以数学的形式表述，任一安全组可以包括n个终端；或者，任一安全组可以包括m个网络资源；或者，任一安全组可以包括n个终端以及m个网络资源。其中，n和m为正整数。安全组可以与安全组策略对应，安全组中的终端和/或网络资源发送的报文、安全组中的终端和/或网络资源接收的报文、不同安全组中的终端和/或网络资源之间相互传输的报文，可以按照安全组对应的安全组策略进行处理。
终端：也称用户终端或用户设备(User Equipment，缩写：UE)。示例性地，终端可以包括手机、平板电脑、个人电脑、笔记本电脑、电话等。可选地，终端可以为移动终端。移动终端的位置可以改变，随着移动终端的位置改变，移动终端的网络地址可以发生改变。移动终端可以包括手机、平板电脑、或 者笔记本电脑等。
网络资源：可以包括计算资源、存储资源、网络环境资源、数据库、网络安全资源、应用服务资源、物联网资源、机器学习资源、软件开发资源等。例如，计算资源可以包括服务器、镜像服务、容器实例等，存储资源可以包括对象存储服务、硬盘等。网络资源的网络地址可以固定，相应地，网络资源可以称为静态资源。网络资源可以为本地资源，也可以为云端资源。该云端资源可以为云计算服务提供的资源，例如云端资源可以为弹性云服务器、虚拟私有云(英文：Virtual Private Cloud)、对象存储服务(英文：Object-Based Storage System，缩写：OBS)、分布式缓存服务、云数据库、应用性能管理(英文：Application Performance Management，缩写：APM)、区块链服务(英文：Blockchain Service)、机器学习(英文：Machine Learning，缩写：ML)服务、分布式消息服务、图像识别服务、自然语言处理(英文：natural language processing，缩写：NLP)服务等。
安全组策略：用于对终端的报文进行处理，从而控制终端的访问权限或者为终端提供的服务质量。安全组策略可以包括访问权限控制策略以及体验保证策略中的至少一项。
访问权限控制策略：用于对任一安全组中的终端和/或网络资源访问其他安全组中的终端和/或网络资源的行为进行控制。例如，可以用于对安全组1中的终端a访问安全组b中的终端2的行为进行控制。访问权限控制策略可以包括允许访问策略以及禁止访问策略中的至少一项。
允许访问策略：用于允许任一安全组中的终端和/或网络资源访问其他安全组中的终端和/或网络资源的行为。当执行节点按照允许访问策略处理报文时，执行节点会将报文转发至被访问设备，以使访问设备能够将报文发送至被访问的设备，实现允许访问设备访问被访问设备的功能。例如，假设安全组1中的终端a要访问安全组2中的终端b，则执行节点接收到终端a向终端b发送的报文时，若匹配安全组1到安全组2的安全组策略时，匹配到允许访问策略，则会向终端b转发终端a的报文。
禁止访问策略：用于禁止任一安全组中的终端和/或网络资源访问其他安全组中的终端和/或网络资源的行为。当执行节点按照禁止访问策略处理报文时，执行节点会丢弃报文，以使访问设备无法将报文发送至被访问的设备，实现禁止访问设备访问被访问设备的功能。例如，假设安全组1中的终端a要访问安全组2中的终端b，则执行节点接收到终端a向终端b发送的报文时，若匹配安全组1到安全组2的安全组策略时，匹配到禁止访问策略，则会丢弃终端a的报文。
体验保证策略：用于对为终端提供的服务质量进行控制。体验保证策略可以包括限速策略、优先调度策略、网关优先接入策略中的至少一项。
限速策略：用于对终端的流量的大小进行控制。例如，限速策略可以包括终端的带宽的阈值，可以通过将终端的带宽控制在不超过该带宽阈值的范围内，以避免网络拥塞。
优先调度策略：用于对转发终端的报文的优先程度进行控制。例如，优先调度策略以包括终端对应的转发优先级，执行节点可以按照该转发优先级，转发终端的报文。例如，假设安全组1中的终端a要访问安全组2中的终端b，则执行节点接收到终端a向终端b发送的报文时，若匹配安全组1到安全组2的安全组策略时，匹配到高优先级的优先调度策略，则会优先转发终端a的报文。
网关优先接入策略：用于对终端接入网关的优先程度进行控制。例如，网关优先接入策略可以包括终端接入网关的优先级，如果某个终端的接入网关的优先级较高，执行节点可以优先将该终端接入网关。
认证节点：用于对终端进行认证，并确定终端所属的安全组。可选地，认证节点可以包括认证点设备以及授权设备中的至少一项。该授权设备以及认证点设备可以进行通信，通过交互以完成认证过程。
认证点设备：用于响应终端的认证请求，将认证请求发送至授权设备，接收授权设备的认证结果，根据认证结果确定是否允许终端接入网络。举例来说，认证点设备的物理实体可以包括无线访问接入点(WirelessAccessPoint，缩写：AP)、防火墙、路由器、交换机等网络设备。具体地，认证点设备可以为 接入层交换机。认证点设备可以部署在本地，也可以部署在云端，例如，认证点设备可以为云计算服务提供的虚拟化资源。认证点设备可以通过网络协议与授权设备保持通信。例如，认证点设备可以通过远程用户拨号认证系统(Remote Authentication Dial In User Service，缩写：Radius)协议与授权设备通信。
关于认证点设备的具体形态，可选地，认证点设备的处理逻辑可以封装为具有认证功能的任意软件的客户端，该客户端可以安装在接入层的一个或多个网络设备上，以使一个或多个网络设备运行该客户端后，成为认证点设备。
授权设备：用于接收认证点设备的认证请求，根据认证请求对终端进行认证，将认证结果发送至认证点设备。另外，授权设备可以在认证过程中或认证通过后，确定终端所属的安全组。可选地，授权设备可以为网络中的控制器节点，可以为网络中认证、授权以及业务策略管理的核心，可以通过与认证点设备交互，以完成对终端认证以及策略下发的功能授权设备可以通过网络协议与认证点设备保持通信。例如，授权设备可以通过Radius协议与认证设备通信。
关于授权设备的具体形态，可选地，授权设备可以为服务器，例如授权设备可以为认证授权计费(Authentication Authorization Accounting，简称：AAA或3A)服务器，授权设备可以部署在园区网络的数据中心。可选地，授权设备可以通过软件实现，例如授权设备的处理逻辑可以为一个软件包，该软件包可以安装在一个或多个物理服务器上，以使一个或多个物理服务器运行该软件包时实现授权设备的功能。
执行节点：也可以称为执行点设备或策略执行点设备。执行节点用于按照安全组策略，处理终端的报文。
关于执行节点的具体形态，可选地，执行节点的物理实体可以包括交换机、防火墙、路由器、无线控制器(Wireless Access Point Controller，缩写：AC)等。可选地，执行节点的处理逻辑可以封装为具有安全组策略执行功能的任意软件的客户端，该客户端可以安装在汇聚层或核心层的一个或多个网络设备上，以使该一个或多个网络设备运行该客户端后，成为执行节点。执行节点可以位于本地，也可以位于云端，例如，执行节点可以为云计算服务提供的虚拟化资源。
同步节点：用于将终端的安全组关联信息同步至至少一个执行节点。如此，认证节点与执行节点可以均存储终端的安全组关联信息，从而令网络转发平面上，执行节点也可以持有终端的授权安全组信息，以便执行节点根据终端的授权安全组信息对终端的报文匹配对应的安全组策略进而按照安全组策略处理报文。
关于同步节点的具体形态，可选地，同步节点可以通过软件实现，例如，同步节点可以通过镜像、应用、服务、微服务、模块、子模块、类或函数中的一项或多项实现；示例性地，同步节点的处理逻辑可以封装为一个软件包，当任一台或多台设备运行该软件包时，即可作为同步节点，以实现同步节点的功能。示例性地，该软件包可以安装在服务器集群上，则该服务器集群运行该软件包时，该服务器集群可以作为同步节点。当然，集群式安装仅是举例，该软件包可以安装在单台服务器上，则该服务器运行该软件包时，该服务器可以作为同步节点。当然，同步节点也可以通过硬件实现，例如同步节点的处理逻辑可以封装在一个或多个芯片上，当任一台或多台设备运行该一个或多个芯片时，即可作为同步节点，以实现同步节点的功能，其中，该芯片可以为单片机、可编程逻辑器件或者其他处理器等。可选地，同步节点的物理实体可以包括服务器、个人计算机、防火墙、路由器、交换机等。可选地，同步节点可以部署在本地，也可以部署在云端。举例来说，同步节点可以部署在园区网络的数据中心，本实施例对同步节点的地理位置不做限定。可选地，同步节点可以独立部署，例如，同步节点可以为一个或多个专门的物理实体，该物理实体无需提供同步节点以外的其他节点设备的功能。当然，同步节点也可以和其他节点设备共同部署，例如，可以令一个或多个物理实体同时提供同步节点以及同步节点以外的其他节点 设备的功能。本实施例对同步节点的部署方式不做限定。可选地，同步节点可以为提供为单机、集群、分布式系统或主从系统，本申请对同步节点的运行方式不做限定。
图1是本申请实施例提供的一种实施环境的架构图，该实施环境包括：终端、认证节点、同步节点以及执行节点，该实施环境中的不同设备可以通过网络连接，其中，认证节点可以用于执行下述实施例中的认证方法；该同步节点可以用于执行下述各个实施例中的信息同步方法；该执行节点可以用于执行下述实施例中的报文处理方法；终端、认证节点、同步节点以及执行节点可以通过交互以执行下述实施例中的业务处理方法。
图1提供的实施环境中的认证节点可以分为认证点设备以及授权设备，认证节点执行的不同步骤可以分别由认证点设备以及授权设备执行，也即是，认证点设备以及授权设备可以通过信息交互，共同实现认证节点的功能。具体地，参见图2，图2是本申请实施例提供的另一种实施环境的架构图，该实施环境包括：终端、认证点设备、同步节点、授权设备以及执行节点。其中，认证点设备以及授权设备可以通过交互执行下述各个实施例中的认证方法；终端、认证点设备、同步节点、授权设备以及执行节点可以通过交互以执行下述各个实施例中的业务处理方法。
图1提供的实施环境中，认证节点以及终端的数量可以为多个，不同终端可以通过不同的认证节点进行认证。具体地，参见图3，图3是本申请实施例提供的另一种实施环境的架构图，该实施环境包括：第一终端、第二终端、第一认证节点、第二认证节点、同步节点、执行节点。其中，第一终端与第一认证节点通过网络连接，第二终端与第二认证节点通过网络连接，第一认证节点以及第二认证节点均可以通过网络和同步节点连接。其中，第一终端、第二终端、第一认证节点、第二认证节点、同步节点、执行节点可以通过交互执行下述各个实施例中的信息同步方法。其中，下述图14至图16实施例可以应用于该图3所示的实施环境中。
图3提供的实施环境中的认证节点也可以分为认证点设备以及授权设备，具体地，参见图4，图4是本申请实施例提供的另一种实施环境的架构图，该实施环境包括：第一终端、第二终端、第一认证点设备、第二认证点设备、同步节点、执行节点以及授权设备。
图1提供的实施环境中，还可以包括一个或多个网络资源。具体地，参见图5，图5是本申请实施例提供的另一种实施环境的架构图，该实施环境包括：终端、认证节点、同步节点、执行节点以及网络资源。其中，下述图17至图19实施例可以应用于该图5所示的实施环境中，相应地，图5实施环境中的终端可以称为第三终端，图5实施环境中的认证节点可以分为第三认证节点以及第四认证节点。
图6是本申请实施例提供的一种计算机设备的结构示意图，该计算机设备600可以提供为下述方法实施例中的同步节点、执行节点、认证节点中的至少一项。
该计算机设备600可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(英文：central processing units，缩写：CPU)601和一个或一个以上的存储器602，其中，该存储器602中存储有至少一条指令，该至少一条指令由该处理器601加载并执行以实现下述方法实施例提供的信息同步方法、报文处理方法以及认证方法中的至少一项。当然，该计算机设备还可以具有有线或无线网络接口以及输入输出接口等部件，以便进行输入输出，该计算机设备还可以包括其他用于实现设备功能的部件，在此不做赘述。其中，计算机设备600可以为云环境中的计算机设备，或边缘环境中的计算机设备，或终端环境中的计算机设备，对此不做限定。
该计算机设备600上运行的操作系统可以是Linux操作系统，当然也可以是其他操作系统，例如为Windows操作系统等，本实施例对此不做限定。
图7是本申请实施例提供的一种计算机设备集群的系统架构图，该计算机设备集群可以提供为下述方法实施例中的同步节点、执行节点、认证节点中的至少一项。
如图7所示，该计算机设备集群包括至少一个计算机设备700，每个计算机设备700可以执行下述方法实施例提供的信息同步方法、报文处理方法以及认证方法中的至少一项中的任一个步骤或任多个步骤，不同的步骤可以由不同的计算机设备700执行。其中，每个计算机设备700的结构与图6实施例中计算机设备600的结构相同。具体来说，每个计算机设备700可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器701和一个或一个以上的存储器702，其中，该存储器702中存储有至少一条指令，该至少一条指令由该处理器701加载并执行以实现下述方法实施例提供的信息同步方法、报文处理方法以及认证方法中的至少一项中的任一个步骤或任多个步骤。每个计算机设备700可以为云环境中的计算机设备，或边缘环境中的计算机设备，或终端环境中的计算机设备，对此不做限定。
图8是本申请实施例提供的另一种计算机设备集群的系统架构图，该计算机设备集群可以提供为下述方法实施例中的同步节点、执行节点、认证节点中的至少一项。
如图8所示，该计算机设备集群包括云计算系统以及至少一个计算机设备800。其中，该云计算系统可以执行下述方法实施例提供的信息同步方法、报文处理方法、认证方法中的任一个步骤或任多个步骤，每个计算机设备800也可以执行下述方法实施例提供的信息同步方法、报文处理方法以及认证方法中的至少一项中的任一个步骤或任多个步骤。图8中的云计算系统可以通过云端的服务器集群实现，该云计算系统可以通过虚拟化技术扩展运算的计算能力，以实现共享软、硬件资源和信息，按需提供给云计算系统中的各个节点设备，使得每个节点设备发挥最大的效能。其中，每个计算机设备800的结构与图6实施例中计算机设备600的结构相同。每个计算机设备800可以为云环境中的计算机设备，或边缘环境中的计算机设备，或终端环境中的计算机设备，对此不做限定。
在示例性实施例中，还提供了一种计算机可读存储介质，例如包括指令的存储器，上述指令可由同步节点的处理器加载并执行以完成下述实施例中的信息同步方法。例如，该计算机可读存储介质可以是只读存储器(Read-Only Memory，简称：ROM)、随机存取存储器(Random Access Memory，RAM)、只读光盘(Compact Disc Read-Only Memory，简称：CD-ROM)、磁带、软盘和光数据存储设备等。
在示例性实施例中，还提供了一种计算机可读存储介质，例如包括指令的存储器，上述指令可由执行节点的处理器加载并执行以完成下述实施例中的报文处理方法。例如，该计算机可读存储介质可以是ROM、RAM、CD-ROM、磁带、软盘和光数据存储设备等。
在示例性实施例中，还提供了一种计算机可读存储介质，例如包括指令的存储器，上述指令可由认证节点的处理器加载并执行以完成下述实施例中的认证方法。例如，该计算机可读存储介质可以是ROM、RAM、CD-ROM、磁带、软盘和光数据存储设备等。
图9是本申请实施例提供的一种认证方法的流程图，该方法的执行主体可以为认证节点，包括以下步骤：
901、认证节点接收终端的认证请求。
当终端接入网络时，终端可以生成认证请求，该认证请求用于对终端进行认证，终端可以将认证请求发送至认证节点，认证节点可以接收终端的认证请求，以便根据认证请求对终端进行认证。
902、认证节点对终端进行认证，得到终端所属的安全组。
关于安全组的确定过程，可选地，认证节点可以根据终端的认证信息，从认证信息与安全组之间的对应关系中，获取终端所属的安全组。
终端的认证信息可以包括用户信息、位置信息以及其他信息中的至少一项。终端的认证信息可以携带在认证请求中，则认证节点可以解析该认证请求，得到认证请求携带的认证信息。当然，认证节点也 可以通过其他方式得到终端的认证信息，例如，认证节点可以接收核心网网元下发的终端的认证信息，或者从某一存储设备中查询终端的认证信息，本实施例对认证信息的获取方式不做限定。
举例来说，用户信息可以包括用户所属的部门、用户的角色、用户标识中的至少一项；位置信息可以为终端当前所处的位置。举例来说，位置信息可以包括终端的接入设备组、终端当前的网络地址的范围、终端的服务集标识(Service Set Identifier，缩写：SSID)中的至少一项。该其他信息可以为用户信息以及位置信息以外的用于认证的任意信息，例如，其他信息可以包括当前时间点所属的时间段、终端所属的终端设备组、定制条件等。关于获取认证信息的方式，可选地，认证节点可以解析终端的认证请求，从认证请求中，获取终端的认证信息，当然也可以通过其他方式获取终端的认证信息，本实施例对获取终端的认证信息的方式不做限定。
认证信息与安全组之间的对应关系可以包括至少一个认证信息以及对应的至少一个安全组。关于获取认证信息与安全组之间的对应关系的方式，可选地，认证节点可以接收配置指令，从配置指令中，获取认证信息与安全组之间的对应关系。其中，该配置指令可以通过配置操作触发，该配置指令可以携带认证信息与安全组之间的对应关系。
需要说明的是，在程序中，认证节点得到的安全组可以通过安全组的组标识来表示，组标识用于标识对应的安全组，可以通过数字、字母、字符串或其他任意数据形式表示。可选地，组标识可以记录为“Group id(组的身份标识号)”。
903、认证节点根据终端的网络地址以及安全组，获取终端的安全组关联信息。
终端的网络地址可以为终端的网络互连协议(Internet Protocol，缩写：IP)地址。关于网络地址的获取方式，可选地，认证节点可以从终端的认证请求或其他请求中获取终端的网络地址。另外，如果认证节点分为认证点设备以及授权设备，认证点设备可以将终端的网络地址发送至授权设备，例如，认证点设备可以在认证过程中，将终端的网络地址发送至授权设备，又如，认证点设备可以在对终端认证通过后，获取终端的网络地址并将终端的网络地址发送至授权设备。
安全组关联信息用于指示终端的网络地址与终端所属的安全组之间的映射关系。在一种可能的实现中，安全组关联信息可以包括终端的网络地址以及安全组的组标识。可选地，安全组关联信息的数据形式可以为一个表项，示例性地，安全组关联信息可以如下表1所示。表1中终端的网络地址为“128.107.162.22”，安全组的标识为“100”。当然，表项仅是安全组关联信息的数据形式的举例，本实施例对安全组关联信息的具体数据形式不做限定。
表1
128.107.162.22 100
可选地，关于安全组关联信息的获取方式，可以对终端的网络地址以及安全组的组标识进行封装，得到安全组关联信息。举例来说，认证节点可以生成一个空白的表项，向该空白的表项写入终端的网络地址以及安全组的组标识，则承载了终端的网络地址以及安全组的组标识的表项即可作为安全组关联信息。当然，这种获取安全组关联信息的方式仅是举例描述，本实施例对获取安全组关联信息的方式不做限定。
可选地，如果认证节点分为认证点设备以及授权设备，可以由授权设备根据终端的网络地址以及安全组，获取终端的安全组关联信息。可选地，授权设备获取安全组关联信息后，可以将安全组关联信息发送至认证点设备。
904、认证节点将安全组关联信息发送至同步节点。
可选地，认证节点在将安全组关联信息发送至同步节点之前，可以建立与同步节点之间的第一网络连接，则可以通过第一网络连接，将安全组关联信息发送至同步节点。其中，第一网络连接是指认证节 点与同步节点之间的网络连接。
可选地，第一网络连接属于加密通道、长连接、连接复用中的至少一种。
如果第一网络连接为加密通道，则认证节点与同步节点在通过加密通道传输任一信息时，认证节点与同步节点可以采用加密算法，对传输的信息进行加密，从而提高信息传输的安全性。其中，该加密算法可以包括对称加密算法、非对称加密算法等。可选地，在建立第一网络连接的过程中，认证节点与同步节点可以进行双向证书认证，即认证节点可以对同步节点的数字证书进行认证，同步节点可以对认证节点的数字证书进行认证。其中，数字证书用于验证公钥的真实性，数字证书是一个包含公钥以及公钥的拥有者的信息的文件。数字证书可以由证书授权(英文：Certificate Authority，简称：CA)中心或企业系统中自定义的可信机构产生。
如果第一网络连接为长连接，则认证节点与同步节点可以通过第一网络连接持续发送多次安全组关联信息，从而节约多次连接时的性能开销。
如果第一网络连接为连接复用，则认证节点与同步节点之间传输的多个请求和/或响应可以复用一个连接，从而减少连接次数，提高信息传输效率。
可选地，第一网络连接可以为基于超文本传输协议2.0(英文：HyperText Transfer Protocol，缩写：HTTP2.0)协议建立的网络连接。当然，基于HTTP2.0协议建立的网络连接仅是对第一网络连接的举例描述，认证节点与同步节点可以通过任一种网络通信协议建立网络连接，例如认证节点与同步节点可以通过某一应用层协议建立网络连接，该应用层协议包括而不限于网络配置(英文：netcof)协议、实时消息传输(英文：Real Time Messaging Protocol，缩写：RTMP)协议等，本实施例对认证节点与同步节点之间的网络通信协议不做限定。
可选地，关于第一网络连接的建立过程，认证节点可以为第一网络连接的客户端，同步节点可以为第一网络连接的服务端。认证节点可以生成第一网络连接请求，向同步节点发送第一网络连接请求，该第一网络连接请求用于请求建立认证节点与同步节点之间的第一网络连接；同步节点可以接收到第一网络连接请求时，向认证节点发送第一网络连接响应，第一网络连接响应用于确认建立第一网络连接。认证节点可以接收同步节点的第一网络连接响应。当然，认证节点为第一网络连接的客户端，同步节点为第一网络连接的服务端的方式仅是举例描述，也可以由认证节点为第一网络连接的服务端，同步节点为第一网络连接的客户端，本实施例对建立第一网络连接的过程不做限定。
通过上述方式以建立第一网络连接的过程达到的效果至少可以包括：第一网络连接可以为双向连接，即，任一个认证节点和同步节点之间进行数据传输时，认证节点和同步节点同客户端和服务端的模式，只需配置一条网络连接即可，极大地减少了配置操作的工作量，并且进少了维护网络连接带来的后期运维的工作量。尤其是，在认证节点数量较多的场景，也只需要在认证节点和同步节点之间配置连接，不会形成网状拓扑(英文：full-mesh)的连接配置，减少了部署和维护工作量。
可选地，认证节点可以按照结构化数据格式，对安全组关联信息进行编码。举例来说，该结构化数据格式可以为协议缓存(英文：protocol buffer)格式。相应地，则本步骤可以包括：将编码后的安全组关联信息发送至同步节点，即将结构化的安全组关联信息发送至同步节点。例如，认证节点可以将protocol buffer格式的安全组关联信息发送至同步节点。通过按照结构化数据格式，对安全组关联信息进行编码，可以令安全组关联信息的传输过程更加轻便高效，从而提高安全组关联信息的传输效率。
可选地，认证节点可以对安全组关联信息进行压缩。具体地，可以采用任意压缩算法，对安全组关联信息进行压缩。举例来说，该压缩算法可以包括拉链(英文：Zip)压缩算法。相应地，本步骤可以包括将压缩后的安全组关联信息发送至同步节点。例如，认证节点可以将Zip格式的安全组关联信息发送至同步节点。通过对安全组关联信息进行压缩，可以减少安全组关联信息的数据量，从而提高安全组 关联信息的传输速度。
可选地，认证节点可以实时将终端的安全组关联信息发送至同步节点。具体地，认证节点可以每当获取任一终端的安全组关联信息时，即将终端的安全组关联信息发送至同步节点，以使终端的安全组策略尽快生效。
可选地，终端的安全组关联信息可以进行更新，相应地，认证节点可以将终端的更新后的安全组关联信息发送至同步节点。具体地，安全组关联信息进行更新的情况可以包括下述情况(1)至情况(3)中的至少一项。
情况(1)终端的网络地址进行更新，相应地，本实施例提供的方法还可以包括下述步骤(1.1)至步骤(1.3)：
步骤(1.1)认证节点获取终端的更新后的网络地址。
可选地，当终端的网络地址更新时，终端可以将更新后的网络地址发送至认证节点，认证节点可以接收终端的更新后的网络地址，从而得到更新后的网络地址。具体地，当终端的网络地址更新时，终端可以将更新后的网络地址发送至认证点设备，认证点设备可以接收终端的更新后的网络地址，将更新后的网络地址发送至授权设备。其中，认证点设备可以根据终端的更新后的网络地址，生成网络地址更新请求，该网络地址更新请求携带更新后的网络地址，则授权设备可以接收网络地址更新请求，对网络地址更新请求进行解析，得到更新后的网络地址。
步骤(1.2)认证节点根据更新后的网络地址以及安全组，获取终端的更新后的安全组关联信息。
更新后的安全组关联信息用于指示更新后的网络地址与终端所属的安全组之间的映射关系。例如，更新后的安全组关联信息可以包括终端的更新后的网络地址以及安全组的组标识。
步骤(1.3)认证节点将更新后的安全组关联信息发送至同步节点。
通过上述步骤(1.1)至步骤(1.3)，达到的效果至少可以包括:如果终端的当前位置发生变化，则终端的网络地址可以发生更新，而认证节点能够随着终端的网络地址的更新，更新安全组关联信息，并将更新后的安全组关联信息上报该同步节点，使得同步节点能够得到更新后的终端的安全组关联信息，保证同步节点存储的终端的安全组关联信息的准确性。
情况(2)终端所属的安全组进行更新。相应地，本实施例提供的方法还可以包括下述步骤(2.1)至步骤(2.3)：
步骤(2.1)认证节点获取终端的更新后的安全组。
具体来说，认证节点可以获取终端的更新后的认证信息，根据终端的更新后的认证信息，从认证信息与安全组之间的对应关系中，获取终端所属的更新后的安全组。
更新后的认证信息可以包括更新后的位置信息、更新后的其他信息、更新后的用户信息等。该更新后的位置信息用于指示终端更新后的位置，该更新后的其他信息可以包括更新后的时间段、更新后的终端组，该更新后的用户信息可以包括更新后的部门、更新后的角色、更新后的账号等，
可选地，更新后的安全组的获取方式可以包括以下方式一至方式二中的任一项或多项的组合。
方式一、认证节点可以获取终端的更新后的位置信息，根据更新后的位置信息，从位置信息与安全组之间的对应关系中，获取终端所属的更新后的安全组。
可选地，位置信息与安全组之间的对应关系可以包括至少一个位置信息以及至少一个安全组的标识，位置信息与安全组之间的对应关系可以在认证节点上预先配置，例如在3A服务器上预先配置。作为一个示例，位置信息与安全组之间的对应关系可以如下表2所示：
表2
位置信息 安全组
办公区 A1
访客区 A2
食堂 A3
宿舍 A4
会议室 A5
在一个示例性场景中，在终端接入网络的期间，假设某一终端当前处于办公区，认证节点从表1所示的位置信息与安全组之间的对应关系中，获取终端所属的安全组为A1，当终端从办公区移动至访客区后，认证节点从表1所示的位置信息与安全组之间的对应关系中，可以获取终端所属的更新后的安全组为A2。
方式二、认证节点可以获取更新后的时间段，根据更新后的时间段，从时间段与安全组之间的对应关系中，获取终端所属的更新后的安全组。
可选地，时间段与安全组之间的对应关系可以包括至少一个时间段以及至少一个安全组的标识。时间段与安全组之间的对应关系可以在认证节点上预先配置，例如在3A服务器上预先配置。作为一个示例，时间段与安全组之间的对应关系可以如下表3所示：
表3
时间段 安全组
07:00至09:00 A1
09:00至11:30 A2
11:30至14:00 A3
14:00至18:00 A4
18:00至21:00 A5
在一个示例性场景中，在终端接入网络的期间，假设某一终端在10:00时接入网络，认证节点从表3所示的时间段与安全组之间的对应关系中，获取终端所属的安全组为A2，在当前时间到达11:30后，认证节点从表3所示的时间段与安全组之间的对应关系中，可以获取终端所属的更新后的安全组为A3。
步骤(2.2)认证节点根据终端的网络地址以及终端所属的更新后的安全组，获取终端的更新后的安全组关联信息。
更新后的安全组关联信息用于指示终端的网络地址与终端所属的更新后的安全组之间的映射关系。例如，更新后的安全组关联信息可以包括终端的网络地址以及更新后的安全组的组标识。
步骤(2.3)认证节点将终端的更新后的安全组关联信息发送至同步节点。
通过上述步骤(2.1)至步骤(2.3)，达到的效果至少可以包括:如果终端的认证信息发生变化，则终端所属的安全组可以发生更新，而认证节点能够随着终端所属的安全组的更新，更新安全组关联信息，并将更新后的安全组关联信息上报该同步节点，使得同步节点能够得到更新后的终端的安全组关联信息，保证同步节点存储的终端的安全组关联信息的准确性。
可选地，当授权设备获取到终端所属的更新后的安全组后，可以将终端所属的更新后的安全组发送至认证点设备。其中，授权设备可以向任一报文写入终端所属的更新后的安全组，将携带了更新后的安全组的报文发送至认证点设备。举例来说，该报文可以为Radius协议中的授权变更(英文：Change-of-Authorization，缩写：CoA)报文。
情况(3)终端的网络地址以及终端所属的安全组均进行更新。相应地，本实施例提供的方法还可以包括下述步骤(3.1)至步骤(3.3)：
步骤(3.1)认证节点获取终端的更新后的网络地址以及终端所属的更新后的安全组。
步骤(3.1)与上述步骤(1.1)以及步骤(2.1)同理，在此不做赘述。
步骤(3.2)认证节点根据终端的更新后的网络地址以及终端所属的更新后的安全组，获取终端的更新后的安全组关联信息。
步骤(3.2)与上述步骤(1.2)以及步骤(2.2)同理，在此不做赘述。
更新后的安全组关联信息用于指示终端的更新后的网络地址与终端所属的更新后的安全组之间的映射关系。例如，更新后的安全组关联信息可以包括终端的更新后的网络地址以及更新后的安全组的组标识。
步骤(3.3)认证节点将更新后的安全组关联信息发送至同步节点。
步骤(3.3)与上述步骤(1.3)同理，在此不做赘述。
本实施例提供的方法，认证节点通过根据终端的网络地址以及安全组，获取终端的安全组关联信息，将安全组关联信息发送至同步节点，能够让同步节点将终端的安全组关联信息同步至执行节点，以便执行节点可以得到终端的安全组关联信息，则执行节点根据安全组关联信息，即可感知到终端所属的安全组，从而能够按照安全组策略对终端的报文进行处理，可以实现认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
图10是本申请实施例提供的一种信息同步方法的流程图，如图10所示，该方法的执行主体可以为同步节点，包括以下步骤：
1001、同步节点接收认证节点发送的终端的安全组关联信息。
可选地，同步节点接收到终端的安全组关联信息后，可以存储终端的安全组关联信息，在一种可能的实现中，同步节点可以包括存储器，可以将终端的安全组关联信息写入该存储器，以使存储器存储终端的安全组关联信息。其中，该存储器可以包括内存以及外部存储器。内存可以是动态随机存取存储器(英文：dynamic random access memory，简称：DRAM)。外部存储器可以包括硬盘、磁盘以及光盘。例如，存储器可以是快闪存储器、NVMe固态硬盘(英文：solid state drives，简称：SSD)。在另一种可能的实现中，同步节点可以将安全组关联信息发送至存储节点，存储节点可以接收安全组关联信息，存储安全组关联信息，同步节点后续可以从存储节点查询安全组关联信息。其中，该存储节点可以包括本地存储设备以及网络存储设备，该网络存储设备可以为云存储系统。
可选地，同步节点在接收认证节点发送的终端的安全组关联信息之前，可以建立与同步节点之间的第一网络连接，则同步节点可以通过第一网络连接，接收认证节点发送的终端的安全组关联信息。其中，第一网络连接的建立过程请参见上述图9实施例，在此不做赘述。
可选地，如果安全组关联信息进行了编码，则同步节点可以接收编码后的安全组关联信息；对编码后的安全组关联信息进行解码，得到安全组关联信息。例如，同步节点可以接收protocol buffer格式的安全组信息，对protocol buffer格式的安全组信息进行解析，得到安全组关联信息。
可选地，如果安全组关联信息进行了压缩，则同步节点可以接收压缩后的安全组关联信息；对压缩后的安全组关联信息进行解压缩，得到安全组关联信息。举例来说，同步节点可以接收Zip格式的安全组信息，对Zip格式的安全组信息进行解压缩，得到安全组关联信息。
1002、同步节点确定至少一个执行节点。
同步节点确定的至少一个执行节点至少包括目标执行节点。具体地，该至少一个执行节点可以仅包括目标执行节点，也可以不仅包括目标执行节点，还包括目标执行节点以外的其他执行节点。其中，目标执行节点是指用于按照安全组策略，处理步骤1001中提及的终端的报文的执行节点。也即是，当得到终端的安全组关联信息后，同步节点至少能够确定出后续该终端的报文会到达的目标执行节点，将终端的安全组关联信息同步至目标执行节点，当然，也不排除还确定出了其他执行节点的情况，本实施例 对此不做限定。
可选地，同步节点可以预先存储至少一个执行节点的网络地址，则同步节点确定至少一个执行节点，可以包括：同步节点读取已存储的至少一个执行节点的网络地址。关于同步节点存储执行节点的网络地址的方式，在一种可能的实现中，同步节点可以将网络地址请求发送至执行节点，执行节点可以接收网络地址请求，将本端的网络地址发送至同步节点，同步节点可以接收执行节点的网络地址，存储执行节点的网络地址。如此，同步节点能够主动发现每个接入网络的执行节点的网络地址。在另一种可能的实现中，当任一执行节点接入网络时，该执行节点可以将本端的网络地址发送至同步节点，同步节点可以接收该执行节点的网络地址，存储执行节点的网络地址。当然，这两种实现方式仅是举例描述，还可以通过其他方式存储执行节点的网络地址，例如，管理员可以在同步节点上触发配置操作，相应地，同步节点可以接收配置指令，从配置指令中得到执行节点的网络地址，本实施例对同步节点存储执行节点的网络地址的方式不做限定。
可选地，同步节点可以预先存储至少一个执行节点的标识，则同步节点确定至少一个执行节点，可以包括：同步节点读取已存储的至少一个执行节点的标识。同步节点存储执行节点的标识的方式与上一段同理，在此不做赘述。
可选地，同步节点确定至少一个执行节点的过程可以包括下述实现方式一至实现方式二：
实现方式一、同步节点确定目标执行节点。
具体地，同步节点可以根据终端的网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定目标网段对应的目标执行节点。
目标网段是指终端的网络地址所属的网段。同步节点可以根据终端的网络地址，获取该该目标网段。
网段与执行节点之间的对应关系可以包括至少一个网段以及至少一个执行节点的标识。网段与执行节点之间的对应关系中任一执行节点可以对应一个或多个网段。其中，执行节点的标识用于标识对应的执行节点，例如，执行节点的标识可以为执行节点的身份标识号(identification，缩写：ID)、编号、名称、序列号等。举例来说，网段与执行节点之间的对应关系可以如下表4所示。
表4
执行节点 网段
执行节点1 202.178.100.0/24
执行节点2 202.178.200.0/24
执行节点3 202.178.300.0/24
可选地，关于网段与执行节点之间的对应关系的获取方式，可选地，同步节点可以接收配置指令，配置指令用于指示网段与执行节点之间的对应关系。同步节点可以解析该配置指令，得到网段与执行节点之间的对应关系。其中，该配置指令可以通过管理员的配置操作触发。同步节点可以支持安全组订阅配置的功能，满足用户的自定义需求。
实现方式二、同步节点确定网络中的每个执行节点。
可选地，同步节点确定网络中的每个执行节点，可以包括：同步节点确定网络中的每个执行节点的网络地址。例如，同步节点可以预先存储网络中的每个执行节点的网络地址，则可以读取已存储的每个执行节点的网络地址。
可选地，同步节点确定网络中的每个执行节点，可以包括：同步节点确定网络中的每个执行节点的。例如，同步节点可以读取已存储的网络中的每个执行节点的标识。例如，同步节点可以预先存储网络中的每个执行节点的标识，则可以读取已存储的每个执行节点的标识。
通过实现方式二，由于网络中的每个执行节点会包括后续终端的报文会到达的目标执行节点，因此 将安全组关联信息推送至网络中的每个执行节点，可以达到将安全组关联信息推送至网络中的目标执行节点的效果，可以保证目标执行节点可以得到安全组关联信息。
可选地，同步节点可以按照结构化数据格式，对安全组关联信息进行编码。举例来说，该结构化数据格式可以为protocol buffer格式。
可选地，同步节点可以对安全组关联信息进行压缩。具体地，可以采用任意压缩算法，对安全组关联信息进行压缩。举例来说，该压缩算法可以包括Zip(拉链)压缩算法。
1003、同步节点将安全组关联信息发送至至少一个执行节点。
结合上述实现方式一，同步节点可以将终端的安全组关联信息发送至目标网段对应的目标执行节点。进一步地，可选地，同步节点可以接收多个终端的安全组关联信息，根据网段与执行节点之间的对应关系，将不同网段的终端的安全组关联信息发送至不同的目标执行节点。例如，参见图11，假设网段1对应执行节点1，网段2对应执行节点2，网段3对应执行节点3，同步节点可以将网络地址属于网段1的所有终端的安全组关联信息发送至执行节点1，将网络地址属于网段2的所有终端的安全组关联信息发送至执行节点2，将网络地址属于网段3的所有终端的安全组关联信息发送至执行节点3，依次类推。
通过实现方式一，达到的效果至少可以包括：当同步节点接收到不同网段的终端的安全组信息时，可以将各个安全组信息分别发送至对应网段的执行节点，可以实现每个执行节点接收本端网段的终端的安全组信息的功能，达到精细化推送的效果，可以避免执行节点由于频繁接收安全组信息，对运行资源的消耗。同时，可以节约执行节点的存储资源，避免单个执行节点待存储的安全组关联信息的数据量过大。尤其是，在接入网络的终端数量庞大的场景中，同步节点待同步的安全组信息数据量庞大，而通过精细化的发送安全组信息，可以提高整个系统的运行效率。
结合上述实现方式二，同步节点可以将终端的安全组关联信息发送至网络的每个执行节点。进一步地，可选地，同步节点可以每当接收到任一终端的安全组关联信息，将该终端的安全组关联信息发送至网络的每个执行节点。
可选地，同步节点在将安全组关联信息发送至至少一个执行节点之前，可以建立与至少一个执行节点之间的第二网络连接，则可以通过第二网络连接，将安全组关联信息发送至至少一个执行节点。其中，第二网络连接是指同步节点与至少一个执行节点之间的网络连接。该第二网络连接响应用于确认建立第二网络连接。
可选地，第二网络连接属于加密通道、长连接、连接复用中的至少一种。
如果第二网络连接为加密通道，则认证节点与至少一个执行节点在通过加密通道传输任一信息时，认证节点与至少一个执行节点可以采用加密算法，对传输的信息进行加密，从而提高信息传输的安全性。其中，该加密算法可以包括对称加密算法、非对称加密算法等。可选地，在建立第二网络连接的过程中，认证节点与至少一个执行节点可以进行双向证书认证，即认证节点可以对至少一个执行节点的数字证书进行认证，至少一个执行节点可以对认证节点的数字证书进行认证。
如果第二网络连接为长连接，则认证节点与至少一个执行节点可以通过第二网络连接持续发送多次安全组关联信息，从而节约多次连接时的性能开销。
如果第二网络连接为连接复用，则认证节点与至少一个执行节点之间传输的多个请求和/或响应可以复用一个连接，从而减少连接次数，提高信息传输效率。
可选地，第二网络连接可以为基于HTTP2.0协议建立的网络连接。当然，基于HTTP2.0协议建立的网络连接仅是对第二网络连接的举例描述，同步节点与至少一个执行节点可以通过任一种网络通信协议建立网络连接，例如通过某一应用层协议建立网络连接，该应用层协议包括而不限于netcof协议、 RTMP协议等，本实施例对同步节点与至少一个执行节点之间的网络通信协议不做限定。
可选地，关于第二网络连接的建立过程，同步节点可以为第二网络连接的客户端，至少一个执行节点可以为第二网络连接的服务端。同步节点可以生成第二网络连接请求，向至少一个执行节点发送第二网络连接请求，该第二网络连接请求用于请求建立同步节点与至少一个执行节点之间的第二网络连接；至少一个执行节点可以接收到第二网络连接请求时，向同步节点发送第二网络连接响应，第二网络连接响应用于确认建立第二网络连接。同步节点可以接收至少一个执行节点的第二网络连接响应。当然，同步节点为第二网络连接的客户端，至少一个执行节点为第二网络连接的服务端的方式仅是举例描述，也可以由同步节点为第二网络连接的服务端，至少一个执行节点为第二网络连接的客户端，本实施例对建立第二网络连接的过程不做限定。
通过上述方式建立第二网络连接，达到的效果至少可以包括：第二网络连接可以为双向连接，即，同步节点和任一个执行节点之间进行数据传输时，同步节点和认证节点通过客户端和服务端的模式，只需配置一条网络连接即可，极大地减少了配置操作的工作量，并且进少了维护网络连接带来的后期运维的工作量。尤其是，在执行节点数量较多的场景，也只需要在执行节点和同步节点之间配置连接，不会形成网状拓扑(英文：full-mesh)的连接配置，减少了部署和维护工作量。
可选地，如果同步节点在步骤1003中，按照结构化数据格式，对安全组关联信息进行编码，则本步骤可以包括：将编码后的安全组关联信息发送至同步节点，即将结构化的安全组关联信息发送至至少一个执行节点。例如，同步节点可以将protocol buffer格式的安全组关联信息发送至至少一个执行节点。
可选地，如果同步节点在步骤1003中，对安全组关联信息进行压缩，则本步骤可以包括：将压缩后的安全组关联信息发送至至少一个执行节点。例如，同步节点可以将Zip格式的安全组关联信息发送至至少一个执行节点。
可选地，如果终端的网络地址和/或安全组进行更新，则终端的安全组关联信息可以进行更新，相应地，本实施例提供的方法还可以包括下述步骤一至步骤三：
步骤一、同步节点接收认证节点发送的终端的更新后的安全组关联信息，更新后的安全组关联信息用于指示终端的更新后的网络地址与安全组之间的映射关系，或者，更新后的安全组关联信息用于指示终端的网络地址与终端所属的更新后的安全组之间的映射关系，或者，更新后的安全组关联信息用于指示终端的更新后的网络地址与终端所属的更新后的安全组之间的映射关系。
可选地，同步节点可以将已存储的终端的安全组关联信息更新为该更新后的安全组关联信息，从而保证存储的终端的安全组关联信息的精确性。
步骤二、同步节点确定至少一个执行节点。
步骤三、同步节点将更新后的安全组关联信息发送至至少一个执行节点。
通过上述步骤一至步骤三，达到的效果至少可以包括:如果终端的当前位置发生变化，则终端的网络地址可以发生更新，而同步节点能够随着终端的网络地址的更新，将更新后的安全组关联信息下发给执行节点，使得执行节点能够得到更新后的终端的安全组关联信息，保证执行节点存储的终端的安全组关联信息的准确性。
本实施例提供的方法，同步节点通过将安全组关联信息从认证节点同步至执行节点上，可以让执行节点得到终端的安全组关联信息，则执行节点根据安全组关联信息，即可感知到终端所属的安全组，从而能够按照安全组策略对终端的报文进行处理，可以实现认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
图12是本申请实施例提供的一种报文处理方法的流程图，如图12所示，该方法的执行主体可以为执行节点，包括以下步骤：
1201、执行节点接收同步节点发送的终端的安全组关联信息。
可选地，执行节点接收到终端的安全组关联信息后，可以存储终端的安全组关联信息，在一种可能的实现中，执行节点可以包括存储器，可以将终端的安全组关联信息写入该存储器，以使存储器存储终端的安全组关联信息。在另一种可能的实现中，执行节点可以将安全组关联信息发送至存储节点，存储节点可以接收安全组关联信息，存储安全组关联信息，执行节点后续可以从存储节点查询安全组关联信息。
可选地，执行节点在接收同步节点发送的终端的安全组关联信息之前，可以建立与同步节点之间的第二网络连接，则可以通过第二网络连接，接收同步节点发送的终端的安全组关联信息。关于建立第二网络连接的过程请参见上述图10实施例，在此不做赘述。
可选地，如果安全组关联信息进行了编码，则执行节点可以接收编码后的安全组关联信息；对编码后的安全组关联信息进行解码，得到安全组关联信息。举例来说，执行节点可以接收结构化数据格式的安全组信息，对结构化数据格式的安全组关联信息进行解析，得到安全组关联信息。例如，执行节点可以接收protocol buffer格式的安全组信息，对protocol buffer格式的安全组信息进行解析，得到安全组关联信息。
可选地，如果安全组关联信息进行了压缩，则执行节点可以接收压缩后的安全组关联信息；对压缩后的安全组关联信息进行解压缩，得到安全组关联信息。举例来说，执行节点可以接收Zip格式的安全组信息，对Zip格式的安全组信息进行解压缩，得到安全组关联信息。
1202、执行节点接收终端的报文。
终端的报文用于承载终端的业务数据，报文可以由终端生成，并发送至执行节点。需要说明的是，网络的不同层次中传输的数据可以具有不同的名称，相应地，报文这一术语可以等同替换为其他术语，例如在传输层，报文也可以称为数据包、packet(包)、数据分组等，在数据链路层，报文也可以称为帧等。
终端的报文可以包括两个不同终端之间传输的报文以及终端与网络资源之间传输的报文中的至少一项。其中，两个不同终端之间传输的报文可以视为两个终端之间的访问行为产生的报文，例如，可以包括一个终端向另一个终端发送的报文以及一个终端接收另一个终端发送的报文中的至少一项。终端与网络资源之间传输的报文可以视为终端与网络资源之间的访问行为产生的报文，例如，可以包括一个终端向网络资源发送的报文以及一个终端接收网络资源发送的报文中的至少一项。
可选地，执行节点接收终端的报文可以包括：执行节点接收终端的流量。该流量也称数据流或报文流，是指连续的多个报文，同一流量的五元组可以相同。可选地，执行节点与终端之间的报文可以通过认证节点转发，相应地，执行节点接收终端的报文可以包括：认证节点接收终端的报文，认证节点将终端的报文发送至执行节点，执行节点接收认证节点发送的终端的报文。
1203、执行节点根据报文携带的网络地址，从安全组关联信息中，获取网络地址对应的安全组。
执行节点可以解析报文，得到报文携带的网络地址，根据网络地址查询安全组关联信息，得到安全组关联信息中网络地址对应的安全组。例如，假设安全组关联信息如上表1所示，则如果执行节点接收到携带有网络地址为“128.107.162.22”的报文，可以从安全组关联信息中，获取网络地址对应的安全组为安全组100。
报文携带的网络地址可以包括源网络地址以及目的网络地址，相应地，本步骤1203可以包括下述(1)至(2)中任一项或多项的组合。其中，为了区分描述，将源网络地址对应的安全组关联信息称为第一安全组关联信息，将目的网络地址对应的安全组关联信息称为第二安全组关联信息，将源网络地址对应的安全组称为第一安全组，将目的网络地址对应的安全组称为第二安全组。其中，术语“第一安全 组关联信息”以及“第一安全组关联信息”用于区分不同的安全组关联信息，而不应理解为明示或暗示不同安全组关联信息在时间或逻辑上的关系，例如不应理解为明示或暗示不同安全组关联信息的生成时间、接收时间、存储时间的早晚顺序以及相对重要性。同理地，术语“第一安全组”以及“第二安全组”用于区分不同的安全组，而不应理解为明示或暗示不同安全组在时间或逻辑上的关系，例如不应理解为明示或暗示不同安全组的生成时间、接收时间、存储时间的早晚顺序以及相对重要性。
(1)根据报文携带的源网络地址，从第一安全组关联信息中，获取源网络地址对应的第一安全组。
该源网络地址可以为报文的源IP地址，终端可以根据源网络地址查询安全组关联信息，得到源网络地址对应的安全组。其中，由于第一安全组为源网络地址对应的安全组，则第一安全组可以称为源安全组。
(2)根据报文携带的目的网络地址，从第二安全组关联信息，获取目的网络地址对应的第二安全组，目的网络地址为第二终端的网络地址。
该目的网络地址可以为报文的目的IP地址，终端可以根据目的网络地址查询安全组关联信息，得到目的网络地址对应的安全组。其中，由于第二安全组为目的网络地址对应的安全组，则第二安全组可以称为目的安全组。
需要说明的第一点是，先描述步骤1203中的(1)再描述步骤1203中的(2)仅是为了表述方便，本实施例对步骤1203中的(1)和(2)并没有时序上的限定。例如，可以先执行步骤1203中的(1)，再执行步骤1203中的(2)；又如，可以先执行步骤1203中的(2)，再执行步骤1203中的(1)；再如，可以同时执行步骤1203中的(1)和步骤1203中的(2)。
需要说明的第二点是，步骤1203中的(1)和步骤1203中的(2)可以择一执行也可以均执行，举例来说，在两个终端互相访问的场景中，两个终端的安全组可以均通过安全组关联信息确定，则执行节点可以执行(1)和(2)，该场景的具体实现方式可以参见下述图14实施例至图16实施例。在终端与网络资源交互的场景中，终端的安全组可以通过安全组关联信息确定，而网络资源的安全组可以通过配置信息确定，则执行节点可以执行(1)和(2)中的任一项，该场景的具体实现方式可以参见下述图17实施例至图19实施例。
1204、执行节点按照安全组匹配的安全组策略，处理报文。
可选地，执行节点可以根据终端所属的安全组，匹配安全组对应的安全组策略。关于安全组策略的匹配方式，在一种可能的实现中，执行节点可以根据终端所属的安全组，从安全组与安全组策略之间的对应关系中，得到安全组匹配的安全组策略。
安全组与安全组策略之间的对应关系用于指示任一安全组对应的安全组策略。例如，安全组与安全组策略之间的对应关系可以包括至少一个安全组的标识以及至少一个安全组策略的标识。该安全组策略的标识用于指示对应的安全组策略，可以为安全组的名称、编号、关键字、序列号等。
可选地，安全组与安全组策略之间的对应关系用于指示源安全组对应的安全组策略以及目的安全组对应的安全组策略。其中，源安全组是指报文的源网络地址对应的安全组，可以视为访问设备所属的安全组。目的安全组是指报文的目的网络地址对应的安全组，可以视为被访问设备所属的安全组。
可选地，安全组与安全组策略之间的对应关系可以为安全组策略矩阵，安全组策略矩阵的行和列可以指代一个或多个安全组。例如，安全组策略矩阵的行可以指代一个或多个源安全组，安全组策略矩阵的行可以指代一个或多个目的安全组。示例性地，安全组与安全组策略之间的对应关系可以如下表5所示。
表5
Figure PCTCN2019122252-appb-000001
可选地，关于安全组与安全组策略之间的对应关系的获取方式，安全组与安全组策略之间的对应关系可以在执行节点上预先存储，执行节点可以读取已存储的安全组与安全组策略之间的对应关系。例如，安全组与安全组策略之间的对应关系可以根据用户的配置操作确定。具体地，执行节点可以接收配置指令，该配置指令用于指示安全组与安全组策略之间的对应关系，该配置指令可以根据用户的配置操作触发，执行节点可以根据配置指令，获取安全组与安全组策略之间的对应关系，存储安全组与安全组策略之间的对应关系。
关于根据安全组与安全组策略之间的对应关系匹配安全组策略的方式，执行节点可以根据报文的源网络地址对应的第一安全组以及目的网络地址对应的第二安全组，从安全组与安全组策略之间的对应关系中，得到与第一安全组匹配、且与第二安全组匹配的安全组策略。在一种可能的实现中，执行节点可以从安全组与安全组策略之间的对应关系中，获取源安全组为第一安全组、目的安全组为第二安全组的安全组策略，该安全组策略即为与第一安全组匹配、且与第二安全组匹配的安全组策略安全组匹配的安全组策略。
结合上述各种可选实施方式，在终端与任一设备交互的场景中，假设终端要访问另一设备，则终端为报文的发送设备，被访问设备为报文的接收设备，在这种情况下，执行节点可以根据终端的网络地址对应的第一安全组以及被访问设备的网络地址对应的第二安全组，从安全组与安全组策略之间的对应关系中，得到源安全组为第一安全组、目的安全组为第二安全组的安全组策略，该安全组策略即为报文匹配的安全组策略。同理地，假设另一设备要访问终端，则终端为报文的接收设备，被访问设备为报文的发送设备，在这种情况下，执行节点可以根据终端的网络地址对应的第一安全组以及被访问设备的网络地址对应的第二安全组，从安全组与安全组策略之间的对应关系中，得到目的安全组为第一安全组匹配、源安全组为第二安全组的安全组策略，该安全组策略即为报文匹配的安全组策略。
在一个示例性场景中，假设安全组与安全组策略之间的对应关系如上表3所示，假设管理员的终端1要访问外包员工的终端2，则终端1会向终端2发起报文，执行节点会接收到终端1至终端2的报文，可以根据终端1的网络地址，得到第一安全组为管理员，根据终端2的网络地址，得到第二安全组为外包员工，则可以从表3中，得到安全组策略为允许访问、高优先级。
关于报文的处理方式，可选地，按照安全组策略处理报文的方式可以包括：转发报文、丢弃报文、控制报文的传输带宽、控制报文的传输速率、控制报文的转发优先级、为报文分配传输资源，将报文存入指定优先级队列中的一项或多项。
举例来说，按照安全组策略处理报文的方式可以包括下述(1)至(2)：
(1)如果安全组匹配的安全组策略为访问权限控制策略，则执行节点可以按照访问权限控制策略，可以对终端的报文进行转发，或者丢弃终端的报文。具体地，如果访问权限控制策略为允许访问策略，则执行节点可以按照允许访问策略，对终端的报文进行转发。如果访问权限控制策略为禁止访问策略， 则执行节点可以按照禁止访问策略，丢弃终端的报文。
(2)如果安全组匹配的安全组策略为体验保证策略，则执行节点可以按照体验保证策略，对终端的报文的流量大小进行控制，例如将终端的带宽控制在不超过该带宽阈值的范围内，以避免网络拥塞，又如按照该转发优先级，转发终端的报文。
在一个示例性场景中，假设出差员工a要访问外包员工b，则出差员工a的终端发送的报文中，源网络地址为出差员工a的终端的网络地址，目的网络地址为出差员工a的终端的网络地址。执行节点可以根据报文的源网络地址，得到第一安全组为出差员工，第二安全组为外包员工；从安全组与安全组策略之间的对应关系中，得到与出差员工匹配、且与外包员工匹配的安全组策略，即“允许访问高优先级”，按照该安全组策略，会允许出差员工a访问外包员工b，并优先转发出差员工a的终端与外包员工b的终端之间传输的报文。
可选地，终端的网络地址和/或安全组进行更新，则终端的安全组关联信息可以进行更新，相应地，本实施例提供的方法还可以包括下述步骤一至步骤四：
步骤一、执行节点接收同步节点发送的终端的更新后的安全组关联信息，更新后的安全组关联信息用于指示终端的更新后的网络地址与安全组之间的映射关系，或者，更新后的安全组关联信息用于指示终端的网络地址与终端所属的更新后的安全组之间的映射关系，或者，更新后的安全组关联信息用于指示终端的更新后的网络地址与终端所属的更新后的安全组之间的映射关系。
可选地，执行节点可以将已存储的终端的安全组关联信息更新为该更新后的安全组关联信息，从而保证存储的终端的安全组关联信息的精确性。
步骤二、执行节点接收终端的报文。
步骤三、执行节点根据报文携带的网络地址，从更新后的安全组关联信息中，获取网络地址对应的安全组。
步骤四、执行节点按照安全组匹配的安全组策略，处理报文。
通过上述步骤一至步骤四，达到的效果至少可以包括:如果终端的当前位置发生变化，则终端的网络地址和/或安全组可以发生更新，而执行节点能够随着终端的网络地址和/或安全组可的更新，更新已存储的终端的安全组关联信息，保证执行节点存储的终端的安全组关联信息的准确性。
本实施例提供的方法，执行节点可以通过同步节点下发的安全组关联信息，得到终端的安全组关联信息，从而能够感知终端所属的安全组，当终端的流量到达执行节点时，执行节点可以按照安全组策略对终端的报文进行处理，实现了认证节点和执行节点的分离，打破了对组网的约束，扩展了应用范围，提高了兼容性。
图13是本申请实施例提供的一种业务处理方法的流程图，如图13所示，该方法的交互主体包括终端、认证节点、同步节点以及执行节点，包括以下步骤：
1301、终端向认证节点发送认证请求。
1302、当认证节点接收到终端的认证请求时，认证节点对终端进行认证，得到终端所属的安全组。
步骤1302可以与上述图9实施例中的步骤901至步骤902同理，在此不做赘述。
1303、认证节点根据终端的网络地址以及安全组，获取终端的安全组关联信息。
步骤1303可以与上述图9实施例中的步骤903同理，在此不做赘述。
1304、认证节点将安全组关联信息发送至同步节点。
步骤1304可以与上述图9实施例中的904同理，在此不做赘述。
1305、当同步节点接收认证节点发送的终端的安全组关联信息，同步节点确定包括目标执行节点的至少一个执行节点，目标执行节点用于按照安全组策略处理终端的报文。
步骤1305可以与上述图10实施例中的1001至步骤1002同理，在此不做赘述。
1306、同步节点将安全组关联信息发送至至少一个执行节点。
步骤1306可以与上述图10实施例中的1003同理，在此不做赘述。
1307、执行节点接收同步节点发送的终端的安全组关联信息。
步骤1307可以与上述图12实施例中的1201同理，在此不做过多赘述。
1308、终端向执行节点发送报文。
1309、当执行节点接收到终端的报文时，执行节点根据报文携带的网络地址，从安全组关联信息中，获取网络地址对应的安全组。
步骤1309可以与上述图12实施例中的1202至步骤1203同理，在此不做过多赘述。
1310、执行节点按照安全组匹配的安全组策略，处理报文。
步骤1310可以与上述图12实施例中的1204同理，在此不做过多赘述。
可选地，本申请实施例提供的方法可以应用于跨认证节点接入的终端之间互访的场景中，具体实现可以如下述图14实施例至图16实施例所示。
为了区分描述，在图14实施例至图16实施例中，将任两个不同的认证节点分别称为第一认证节点以及第二认证节点，将通过第一认证节点认证的终端称为第一终端，将通过第二认证节点认证的终端称为第二终端，将第一终端所属的安全组称为第一安全组，将第二终端所属的安全组称为第二安全组，将接收到第一终端与第二终端之间传输的报文的执行节点称为第一目标执行节点。
图14是本申请实施例提供的一种信息同步方法的流程图，如图14所示，该方法的执行主体可以为同步节点，包括以下步骤：
1401、同步节点接收第一认证节点发送的第一终端的第一安全组关联信息。
第一安全组关联信息用于指示第一终端的网络地址与第一终端所属的第一安全组之间的映射关系。例如，第一安全组关联信息可以包括第一终端的网络地址以及第一安全组的组标识。第一安全组关联信息可以在第一认证节点对第一终端认证的过程中生成。
具体地，第一认证节点对第一终端认证的过程可以包括：第一认证节点接收第一终端的认证请求，第一认证节点对第一终端进行认证，得到第一终端所属的第一安全组；根据第一终端的网络地址以及第一安全组，获取第一终端的第一安全组关联信息；将第一安全组关联信息发送至同步节点。其中，该过程可以参见上述图9实施例，在此不做赘述。
可选地，如果第一安全组关联信息进行了编码，则同步节点可以接收编码后的第一安全组关联信息；对编码后的第一安全组关联信息进行解码，得到第一安全组关联信息；
可选地，如果第一安全组关联信息进行了压缩，则同步节点可以接收压缩后的安全组关联信息；对压缩后的第一安全组关联信息进行解压缩，得到第一安全组关联信息。
1402、同步节点接收第二认证节点发送的第二终端的第二安全组关联信息。
第二认证节点与第一认证节点不同，第二认证节点与第一认证节点可以为网络中任两个不同的认证节点。举例来说，第二认证节点与第一认证节点可以部署在不同的地理位置。
第二安全组关联信息用于指示第二终端的网络地址与第二终端所属的第二安全组之间的映射关系。例如，第二安全组关联信息可以包括第二终端的网络地址以及第二安全组的组标识。第二安全组关联信息可以在第二认证节点对第二终端认证的过程中生成。
具体地，第二认证节点对第二终端认证的过程可以包括：第二认证节点接收第二终端的认证请求，第二认证节点对第二终端进行认证，得到第二终端所属的第二安全组；根据第二终端的网络地址以及第二安全组，获取第二终端的第二安全组关联信息；将第二安全组关联信息发送至同步节点。其中，该过 程可以参见上述图10实施例，在此不做赘述。
需要说明的是，先描述步骤1401再描述步骤1402仅是为了表述方便，本实施例对步骤1401和步骤1402这两个步骤不做时序上的限定。例如，可以先执行步骤1401，再执行步骤1402；又如，可以先执行步骤1402，再执行步骤1401；再如，可以同时执行步骤1401和步骤1402。
可选地，如果第二安全组关联信息进行了编码，则同步节点可以接收编码后的第二安全组关联信息；对编码后的第二安全组关联信息进行解码，得到第二安全组关联信息。
可选地，可选地，如果第二安全组关联信息进行了压缩，则同步节点可以接收压缩后的安全组关联信息；对压缩后的第二安全组关联信息进行解压缩，得到第二安全组关联信息。
1403、同步节点确定包括第一目标执行节点的至少一个执行节点，第一目标执行节点用于按照安全组策略处理第一终端与第二终端之间传输的报文。
可选地，同步节点确定至少一个执行节点的过程可以包括下述实现方式一至实现方式二：
实现方式一、同步节点确定第一目标执行节点。
可选地，实现方式一可以包括：同步节点根据第一终端的网络地址所属的第一目标网段，从网段与执行节点之间的对应关系中，获取第一目标网段对应的第一目标执行节点；根据第二终端的网络地址所属的第二目标网段，从网段与执行节点之间的对应关系中，获取第二目标网段对应的第一目标执行节点。
其中，第一目标网段是指第一终端的网络地址所属的网段，第二目标网段是指第二终端的网络地址所属的网段。可选地，第一目标网段和第二目标网段可以不同，而第一目标网段对应的执行节点以及第二目标网段对应的执行节点相同，第一目标网段以及第二目标网段对应的执行节点均为该第一目标执行节点。可选地，第一目标网段和第二目标网段可以相同，第一目标网段以及第二目标网段对应的执行节点均为该第一目标执行节点。
实现方式二、确定网络中的每个执行节点。
可选地，同步节点可以按照结构化数据格式，对第一安全组关联信息进行编码，得到编码后的第一安全组关联信息。
可选地，同步节点可以对第一安全组关联信息进行压缩，得到压缩后的第一安全组关联信息。
1404、同步节点将第一安全组关联信息发送至至少一个执行节点。
步骤1404可以与上述图10实施例中的1003同理，在此不做赘述。
可选地，同步节点可以将编码后的第一安全组关联信息发送至至少一个执行节点。可选地，同步节点可以将压缩后的第一安全组关联信息发送至至少一个执行节点。
可选地，第一终端以及第二终端中的至少一项的安全组关联信息可以发生更新，相应地，认证节点可以将第一终端的更新后的安全组关联信息发送至同步节点，也可以将第二终端的更新后的安全组关联信息发送至同步节点。
具体地，第一终端的安全组关联信息进行更新的情况可以包括下述情况(1)至情况(3)中的至少一项。
情况(1)第一终端的网络地址进行更新，则认证节点执行的方法还可以包括下述步骤(1.1)至步骤(1.3)：
步骤(1.1)第一认证节点获取第一终端的更新后的网络地址。
可选地，当第一终端的网络地址更新时，第一终端可以将更新后的网络地址发送至第一认证节点，第一认证节点可以接收第一终端的更新后的网络地址，从而得到更新后的网络地址。具体地，当第一终端的网络地址更新时，第一终端可以将更新后的网络地址发送至认证点设备，第一认证点设备可以接收第一终端的更新后的网络地址，将更新后的网络地址发送至授权设备。其中，第一认证点设备可以根据 第一终端的更新后的网络地址，生成网络地址更新请求，该第一网络地址更新请求携带更新后的网络地址，则授权设备可以接收第一网络地址更新请求，对第一网络地址更新请求进行解析，得到更新后的网络地址。
步骤(1.2)第一认证节点根据更新后的网络地址以及第一安全组，获取第一终端的更新后的第一安全组关联信息。
更新后的第一安全组关联信息用于指示更新后的网络地址与第一终端所属的第一安全组之间的映射关系。例如，更新后的第一安全组关联信息可以包括第一终端的更新后的网络地址以及第一安全组的组标识。
步骤(1.3)第一认证节点将更新后的第一安全组关联信息发送至同步节点。
与情况(1)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第一认证节点发送的第一终端的更新后的第一安全组关联信息；
步骤b、同步节点将更新后的第一安全组关联信息发送至至少一个执行节点；
其中，更新后的第一安全组关联信息用于指示第一终端的更新后的网络地址与第一安全组之间的映射关系。
情况(2)第一终端所属的安全组进行更新。相应地，认证节点执行的方法还可以包括下述步骤(2.1)至步骤(2.3)：
步骤(2.1)第一认证节点获取第一终端的更新后的第一安全组。
具体来说，第一认证节点可以获取第一终端的更新后的认证信息，根据第一终端的更新后的认证信息，从认证信息与第一安全组之间的对应关系中，获取第一终端所属的更新后的第一安全组。
更新后的认证信息可以包括更新后的位置信息、更新后的其他信息、更新后的用户信息等。该更新后的位置信息用于指示第一终端的更新后的位置，该更新后的其他信息可以包括更新后的时间段、更新后的第一终端组，该更新后的用户信息可以包括更新后的部门、更新后的角色、更新后的账号等，
可选地，更新后的第一安全组的获取方式可以包括以下方式一至方式二中的任一项或多项的组合。
方式一、第一认证节点可以获取第一终端的更新后的位置信息，根据更新后的位置信息，从位置信息与第一安全组之间的对应关系中，获取第一终端所属的更新后的第一安全组。
可选地，位置信息与第一安全组之间的对应关系可以包括至少一个位置信息以及至少一个第一安全组的标识，位置信息与第一安全组之间的对应关系可以在第一认证节点上预先配置，例如在3A服务器上预先配置。
方式二、第一认证节点可以获取更新后的时间段，根据更新后的时间段，从时间段与第一安全组之间的对应关系中，获取第一终端所属的更新后的第一安全组。
可选地，时间段与第一安全组之间的对应关系可以包括至少一个时间段以及至少一个第一安全组的标识。时间段与第一安全组之间的对应关系可以在第一认证节点上预先配置。
步骤(2.2)第一认证节点根据第一终端的网络地址以及第一终端所属的更新后的第一安全组，获取第一终端的更新后的第一安全组关联信息。
更新后的第一安全组关联信息用于指示第一终端的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。例如，更新后的第一安全组关联信息可以包括第一终端的网络地址以及更新后的第一安全组的组标识。
步骤(2.3)第一认证节点将第一终端的更新后的第一安全组关联信息发送至同步节点。
与情况(2)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第一认证节点发送的第一终端的更新后的第一安全组关联信息；
步骤b、同步节点将更新后的第一安全组关联信息发送至至少一个执行节点；
其中，更新后的第一安全组关联信息用于指示第一终端的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。
情况(3)第一终端的网络地址以及第一终端所属的安全组均进行更新。相应地，本实施例提供的方法还可以包括下述步骤(3.1)至步骤(3.3)：
步骤(3.1)第一认证节点获取第一终端的更新后的网络地址以及第一终端所属的更新后的第一安全组。
步骤(3.1)与上述步骤(1.1)以及步骤(1.2)同理，在此不做赘述。
步骤(3.2)、第一认证节点根据第一终端的更新后的网络地址以及第一终端所属的更新后的第一安全组，获取第一终端的更新后的第一安全组关联信息。
更新后的第一安全组关联信息用于指示第一终端的更新后的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。例如，更新后的第一安全组关联信息可以包括第一终端的更新后的网络地址以及更新后的第一安全组的组标识。
步骤(3.3)、第一认证节点将更新后的第一安全组关联信息发送至同步节点。
与情况(3)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第一认证节点发送的第一终端的更新后的第一安全组关联信息；
步骤b、同步节点将更新后的第一安全组关联信息发送至至少一个执行节点；
其中，更新后的第一安全组关联信息用于指示第一终端的更新后的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。
同理地，可选地，第二终端的第二安全组关联信息也可以进行更新，第二安全组关联信息进行更新的情况可以包括下述情况(1)至情况(3)中的至少一项。
情况(1)第二终端的网络地址发生更新，则认证节点执行的方法还可以包括下述步骤(1.1)至步骤(1.3)：
步骤(1.1)第二认证节点获取第二终端的更新后的网络地址。
可选地，当第二终端的网络地址更新时，第二终端可以将更新后的网络地址发送至第二认证节点，第二认证节点可以接收第二终端的更新后的网络地址，从而得到更新后的网络地址。具体地，当第二终端的网络地址更新时，第二终端可以将更新后的网络地址发送至第二认证点设备，认证点设备可以接收第二终端的更新后的网络地址，将更新后的网络地址发送至授权设备。其中，认证点设备可以根据第二终端的更新后的网络地址，生成网络地址更新请求，该网络地址更新请求携带更新后的网络地址，则授权设备可以接收网络地址更新请求，对网络地址更新请求进行解析，得到更新后的网络地址。
步骤(1.2)第二认证节点根据更新后的网络地址以及第二安全组，获取第二终端的更新后的第二安全组关联信息。
更新后的第二安全组关联信息用于指示更新后的网络地址与第二终端所属的第二安全组之间的映射关系。例如，更新后的第二安全组关联信息可以包括第二终端的更新后的网络地址以及第二安全组的组标识。
步骤(1.3)第二认证节点将更新后的第二安全组关联信息发送至同步节点。
与情况(1)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第二认证节点发送的第二终端的更新后的第二安全组关联信息；
步骤b、同步节点将更新后的第二安全组关联信息发送至至少一个执行节点；
其中，更新后的第二安全组关联信息用于指示第二终端的更新后的网络地址与第二安全组之间的映 射关系。
情况(2)第二终端所属的安全组进行更新。相应地，本实施例提供的方法还可以包括下述步骤(2.1)至步骤(2.3)：
步骤(2.1)第二认证节点获取第二终端的更新后的第二安全组。
具体来说，第二认证节点可以获取第二终端的更新后的认证信息，根据第二终端的更新后的认证信息，从认证信息与第二安全组之间的对应关系中，获取第二终端所属的更新后的第二安全组。
更新后的认证信息可以包括更新后的位置信息、更新后的其他信息、更新后的用户信息等。该更新后的位置信息用于指示第二终端的更新后的位置，该更新后的其他信息可以包括更新后的时间段、更新后的第二终端组，该更新后的用户信息可以包括更新后的部门、更新后的角色、更新后的账号等，
可选地，更新后的第二安全组的获取方式可以包括以下方式一至方式二中的任一项或多项的组合。
方式一、第二认证节点可以获取第二终端的更新后的位置信息，根据更新后的位置信息，从位置信息与第二安全组之间的对应关系中，获取第二终端所属的更新后的第二安全组。
可选地，位置信息与第二安全组之间的对应关系可以包括至少一个位置信息以及至少一个第二安全组的标识，位置信息与第二安全组之间的对应关系可以在第二认证节点上预先配置，例如在3A服务器上预先配置。
方式二、第二认证节点可以获取更新后的时间段，根据更新后的时间段，从时间段与第二安全组之间的对应关系中，获取第二终端所属的更新后的第二安全组。
可选地，时间段与第二安全组之间的对应关系可以包括至少一个时间段以及至少一个第二安全组的标识。时间段与第二安全组之间的对应关系可以在第二认证节点上预先配置。
步骤(2.2)第二认证节点根据第二终端的网络地址以及第二终端所属的更新后的第二安全组，获取第二终端的更新后的第二安全组关联信息。
更新后的第二安全组关联信息用于指示第二终端的网络地址与第二终端所属的更新后的第二安全组之间的映射关系。例如，更新后的第二安全组关联信息可以包括第二终端的网络地址以及更新后的第二安全组的组标识。
步骤(2.3)、第二认证节点将第二终端的更新后的第二安全组关联信息发送至同步节点。
与情况(2)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第一认证节点发送的第一终端的更新后的第一安全组关联信息；
步骤b、同步节点将更新后的第一安全组关联信息发送至至少一个执行节点；
其中，更新后的第一安全组关联信息用于指示第一终端的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。
情况(3)第二终端的网络地址以及第二终端所属的第二安全组均进行更新。相应地，本实施例提供的方法还可以包括下述步骤(3.1)至步骤(3.3)：
步骤(3.1)第二认证节点获取第二终端的更新后的网络地址以及第二终端所属的更新后的第二安全组。
步骤(3.1)与上述步骤(1.1)以及步骤(1.2)同理，在此不做赘述。
步骤(3.2)第二认证节点根据第二终端的更新后的网络地址以及第二终端所属的更新后的第二安全组，获取第二终端的更新后的第二安全组关联信息。
更新后的第二安全组关联信息用于指示第二终端的更新后的网络地址与第二终端所属的更新后的第二安全组之间的映射关系。例如，更新后的第二安全组关联信息可以包括第二终端的更新后的网络地址以及更新后的第二安全组的组标识。
步骤(3.3)第二认证节点将第二终端的更新后的第二安全组关联信息发送至同步节点。
与情况(3)对应的，本实施例提供的方法可以包括下述步骤a至步骤b：
步骤a、同步节点接收第二认证节点发送的第二终端的更新后的第二安全组关联信息；
步骤b、同步节点将更新后的第二安全组关联信息发送至至少一个执行节点；
其中，更新后的第二安全组关联信息用于指示第二终端的更新后的网络地址与第二终端所属的更新后的第二安全组之间的映射关系。
本实施例提供的方法，同步节点通过将第一终端的第一安全组关联信息以及第二终端的第二安全组关联信息同步至执行节点，可以让执行节点同时持有从两个不同认证节点认证的终端的安全组关联信息，以使执行节点能够感知从两个不同认证节点认证的终端所属的安全组，那么当执行节点接收到从两个不同认证节点认证的终端之间传输的报文时，可以按照两个终端所属的安全组匹配的安全组策略处理报文，能够对跨认证节点接入的终端之间互访的权限进行控制。
图15是本申请实施例提供的一种报文处理方法的流程图，如图15所示，执行主体可以为执行节点，包括以下步骤：
1501、执行节点接收同步节点发送的第一终端的第一安全组关联信息。
步骤1501可以与上述图12实施例中的1201同理，在此不做赘述。
可选地，如果第一安全组关联信息进行了编码，则执行节点可以接收编码后的第一安全组关联信息；对编码后的第一安全组关联信息进行解码，得到第一安全组关联信息。
可选地，如果第一安全组关联信息进行了压缩，则执行节点可以接收压缩后的第一安全组关联信息；对压缩后的第一安全组关联信息进行解压缩，得到第一安全组关联信息。
1502、执行节点接收同步节点发送的第二终端的第二安全组关联信息。
步骤1502可以与上述图12实施例中的1201同理，在此不做赘述。
需要说明的是，先描述步骤1501再描述步骤1502仅是为了表述方便，本实施例对步骤1501和步骤1502这两个步骤不做时序上的限定。例如，可以先执行步骤1501，再执行步骤1502；又如，可以先执行步骤1502，再执行步骤1501；再如，可以同时执行步骤1501和步骤1502。
可选地，如果第二安全组关联信息进行了编码，则执行节点可以接收编码后的第二安全组关联信息；对编码后的第二安全组关联信息进行解码，得到第二安全组关联信息。可选地，如果第二安全组关联信息进行了压缩，则执行节点可以接收压缩后的第二安全组关联信息；对压缩后的第二安全组关联信息进行解压缩，得到第二安全组关联信息。
1503、执行节点接收第一终端与第二终端之间传输的报文。
第一终端与第二终端之间传输的报文可以包括第一终端向第二终端发送的报文以及第二终端向第一终端发送的报文中的至少一项。
对于第一终端向第二终端发送的报文来说，报文的源网络地址可以为第一终端的网络地址，报文的目的网络地址可以为第二终端的网络地址；相应地，步骤1503可以包括：执行节点接收到第一终端发送的、待发送至第二终端的报文。
对于第二终端向第一终端发送的报文来说，报文的源网络地址可以为第二终端的网络地址，报文的目的网络地址可以为第一终端的网络地址。相应地，步骤1503可以包括：执行节点接收到第二终端发送的、待发送至第一终端的报文。
1504、执行节点根据报文携带的网络地址，从安全组关联信息中，获取网络地址对应的第一安全组以及第二安全组。
通过执行步骤1501以及步骤1502，执行节点既得到了通过第一认证节点认证的第一终端的安全组 关联信息，又得到了通过第二认证节点认证的第二终端的安全组关联信息，从而同时持有了从不同认证节点接入的终端的安全组关联信息，因此，当不同终端之间传输的报文到达执行节点时，执行节点可以通过不同终端的安全组关联信息，控制不同终端之间的互访权限。
如果报文为第一终端向第二终端发送的报文，则步骤1504可以包括下述(1.1)和(1.2)。
(1.1)根据报文携带的源网络地址，从第一安全组关联信息中，获取源网络地址对应的第一安全组。具体地，如果报文的源网络地址为第一终端的网络地址，则根据第一终端的网络地址以及第一终端的第一安全组关联信息，即可确定第一终端所属的第一安全组。
(1.2)根据报文携带的目的网络地址，从第二安全组关联信息，获取目的网络地址对应的第二安全组，目的网络地址为第二终端的网络地址。具体地，如果报文的目的网络地址为第二终端的网络地址，则根据第二终端的网络地址以及第二终端的第二安全组关联信息，即可确定第二终端所属的第二安全组。
如果报文为第二终端向第一终端发送的报文，则步骤1504可以包括下述(2.1)和(2.2)。
(2.1)根据报文携带的源网络地址，从第二安全组关联信息中，获取源网络地址对应的第二安全组。具体地，如果报文的源网络地址为第二终端的网络地址，则根据第二终端的网络地址以及第二终端的第二安全组关联信息，即可确定第二终端所属的第二安全组。
(2.2)根据报文携带的目的网络地址，从第一安全组关联信息，获取目的网络地址对应的第一安全组。具体地，如果报文的目的网络地址为第一终端的网络地址，则根据第一终端的网络地址以及第一终端的第一安全组关联信息，即可确定第一终端所属的第一安全组。
1505、执行节点按照与第一安全组匹配、且与第二安全组匹配的安全组策略，处理报文。
可选地，执行节点可以根据第一终端所属的第一安全组以及第二终端所属的第二安全组，匹配第一安全组以及第二安全组对应的安全组策略。在一种可能的实现中，执行节点可以根据第一终端所属的第一安全组以及第二终端所属的第二安全组，从安全组与安全组策略之间的对应关系中，得到第一安全组以及第二安全组对应的安全组策略。其中，安全组与安全组策略之间的对应关系的描述请参见上述图12实施例中的1204，在此不做赘述。
关于根据安全组与安全组策略之间的对应关系匹配安全组策略的方式，假设源安全组为第一安全组、目的安全组为第二安全组的安全组策略称为第一安全组策略，源安全组为第二安全组、目的安全组为第一安全组的安全组策略称为第二安全组策略，匹配安全组策略的方式可以参见下述情况一以及情况二：
情况一、如果报文为第一终端向第二终端发送的报文，则匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取第一安全组策略。示例性地，参见上表3，假设报文为出差员工的终端向外包员工的终端发送的报文，则源安全组为出差员工，目的安全组为外包员工，匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取源安全组为出差员工，且目的安全组为外包员工的安全组策略，即“允许访问低优先级”。
情况二、如果报文为第二终端向第一终端发送的报文，则匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取第二安全组策略。示例性地，参见上表3，假设报文为外包员工的终端向出差员工的终端发送的报文，则源安全组为外包员工，目的安全组为出差员工，匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取源安全组为外包员工且目的安全组为出差员工的安全组策略，即“禁止访问”。
可选地，第一安全组策略与第二安全组策略可以不同。如此，对第一终端向第二终端发送的报文的处理方式、对第二终端向第一终端发送的报文的处理方式可以不同。具体来讲，可以包括下述实现(1) 以及实现(2)中的任一项或多项。
实现(1)第一安全组策略中的访问权限控制策略与第二安全组策略中的访问权限控制策略可以不同，从而实现第一终端访问第二终端的权限与第二终端访问第一终端的权限不同的功能，例如可以允许第一终端访问第二终端，禁止第二终端访问第一终端。在一个示例性场景中，可以允许管理员的终端访问外包员工的终端，禁止外包员工的终端访问管理员的终端。
实现(2)第一安全组策略中的体验保证策略与第二安全组策略中的体验保证策略可以不同，从而实现第一终端访问第二终端的服务质量与第二终端访问第一终端的服务质量不同的功能，例如可以高优先转发第一终端访问第二终端的报文，低优先转发第二终端访问第一终端的报文。
当然，第一安全组策略与第二安全组策略不同仅是可选方式，第一安全组策略与第二安全组策略也可以相同，本实施例对此不做限定。
可选地，第一终端以及第二终端中的至少一项的网络地址和/或安全组进行更新，则第一终端以及第二终端中的至少一项的安全组关联信息可以进行更新。相应地，本实施例提供的方法还可以包括下述步骤(1.1)至步骤(1.4)：
步骤(1.1)执行节点接收同步节点发送的第一终端的更新后的第一安全组关联信息，更新后的第一安全组关联信息用于指示第一终端的更新后的网络地址与第一安全组之间的映射关系，或者，更新后的第一安全组关联信息用于指示第一终端的网络地址与第一终端所属的更新后的第一安全组之间的映射关系，或者，更新后的第一安全组关联信息用于指示第一终端的更新后的网络地址与第一终端所属的更新后的第一安全组之间的映射关系。
可选地，执行节点可以将已存储的第一终端的第一安全组关联信息更新为该更新后的第一安全组关联信息。
步骤(1.2)执行节点接收第一终端与第二终端之间传输的报文。
其中，对于第一终端向第二终端发送的报文来说，报文的源网络地址可以为第一终端的更新后的网络地址，报文的目的网络地址可以不变，仍为第二终端的网络地址。对于第二终端向第一终端发送的报文来说，报文的源网络地址可以不变，仍为第二终端的网络地址，报文的目的网络地址可以为第一终端的更新后的网络地址。
步骤(1.3)执行节点根据报文携带的网络地址，从更新后的第一安全组关联信息，以及第二安全组关联信息中，获取第一终端的更新后的网络地址对应的第一安全组，以及第二终端的网络地址对应的第二安全组。
步骤(1.4)执行节点按照与第一安全组匹配、且与第二安全组匹配的安全组策略，处理报文。
如果第二终端的安全组关联信息发生更新，则本实施例提供的方法还可以包括下述步骤(2.1)至步骤(2.4)：
步骤(2.1)执行节点接收同步节点发送的第二终端的更新后的第二安全组关联信息，更新后的第二安全组关联信息用于指示第二终端的更新后的网络地址与第二安全组之间的映射关系，或者，更新后的第二安全组关联信息用于指示第二终端的网络地址与第二终端所属的更新后的第二安全组之间的映射关系，或者，更新后的第二安全组关联信息用于指示第二终端的更新后的网络地址与第二终端所属的更新后的第二安全组之间的映射关系。
可选地，执行节点可以将已存储的第二终端的第二安全组关联信息更新为该更新后的第二安全组关联信息。
步骤(2.2)执行节点接收第一终端与第二终端之间传输的报文。
其中，对于第一终端向第二终端发送的报文来说，报文的源网络地址可以不变，仍为第一终端的网 络地址，报文的目的网络地址可以为第二终端的更新后的网络地址。对于第二终端向第一终端发送的报文来说，报文的源网络地址可以为第二终端的更新后的网络地址，报文的目的网络地址可以不变，仍为第一终端的网络地址。
步骤(2.3)执行节点根据报文携带的网络地址，从第一安全组关联信息，以及更新后的第二安全组关联信息中，获取第一终端的网络地址对应的第一安全组，以及第二终端的更新后的网络地址对应的第二安全组。
步骤(2.4)执行节点按照与第一安全组匹配、且与第二安全组匹配的安全组策略，处理报文。
需要说明的是，上述步骤(1.1)至步骤(1.4)、步骤(2.1)至步骤(2.4)仅是可选步骤，而非必选步骤。另外，上述步骤(1.1)至步骤(1.4)、步骤(2.1)至步骤(2.4)可以择一执行，也可以均执行。
本实施例提供的方法，执行节点通过接收同步节点发送的第一终端的第一安全组关联信息以及第二终端的第二安全组关联信息，可以同时持有从两个不同认证节点认证的终端的安全组关联信息，从而能够感知从两个不同认证节点认证的终端所属的安全组，那么当执行节点接收到从两个不同认证节点认证的终端之间传输的报文时，可以按照与两个终端所属的安全组匹配的安全组策略，处理报文，从而能够对跨认证节点接入的终端之间互访的权限进行控制。
图16是本申请实施例提供的一种业务处理方法的流程图，如图16所示，交互主体包括第一终端、第二终端、第一认证节点、第二认证节点、同步节点以及执行节点，包括以下步骤：
1601、第一终端向第一认证节点发送认证请求。
1602、当第一认证节点接收第一终端的认证请求时，第一认证节点对第一终端进行认证，得到第一终端所属的第一安全组。
1603、第一认证节点根据第一终端的网络地址以及安全组，获取第一终端的安全组关联信息，第一安全组关联信息用于指示网络地址与终端所属的安全组之间的映射关系；
1604、第一认证节点将第一安全组关联信息发送至同步节点。
1605、第二终端向第二认证节点发送认证请求。
1606、当第二认证节点接收第二终端的认证请求时，第二认证节点对第二终端进行认证，得到第二终端所属的第二安全组。
1607、第二认证节点根据终端的网络地址以及安全组，获取第二终端的第二安全组关联信息。
1608、第二认证节点将第二安全组关联信息发送至第二同步节点。
需要说明的是，先描述步骤1601至步骤1604，再描述步骤1605至步骤1608，仅是为了表述方便，本实施例对步骤1601至步骤1604、步骤1605至步骤1608这两种过程不做时序上的限定。例如，可以先执行步骤1601至步骤1604，后执行步骤1605至步骤1608；又如，可以后执行步骤1601至步骤1604，先执行步骤1605至步骤1608，再执行步骤1601至步骤1604；再如，可以同时执行步骤1601至步骤1604以及执行步骤1605至步骤1608。其中，该先执行步骤1601至步骤1604，再执行步骤1605至步骤1608可以包括：步骤1601至步骤1604的执行时间段早于步骤1605至步骤1608的执行时间段的情况，也可以包括：步骤1601至步骤1604的执行时间段与步骤1605至步骤1608的执行时间段重叠，且步骤1604的执行时间点早于步骤1605的执行时间点等情况；同理地，该后执行步骤1601至步骤1604，先执行步骤1605至步骤1608可以包括：步骤1601至步骤1604的执行时间段晚于步骤1605至步骤1608的执行时间段的情况，也可以包括：步骤1601至步骤1604的执行时间段与步骤1605至步骤1608的执行时间段重叠，且步骤1601的执行时间点晚于步骤1608的执行时间点等情况。
1609、同步节点接收第一认证节点发送的第一终端的第一安全组关联信息以及第二认证节点发送的 第二终端的第二安全组关联信息。
1610、同步节点确定包括第一目标执行节点的至少一个执行节点，第一目标执行节点用于按照安全组策略处理终端的报文。
1611、同步节点将第一终端的第一安全组关联信息以及第二终端的第二安全组关联信息发送至至少一个执行节点。
1612、执行节点接收第一终端的第一安全组关联信息以及第二终端的第二安全组关联信息。
以下，通过步骤1613至步骤1615，描述第一终端访问第二终端时的报文处理流程，通过步骤1616至步骤1618，描述第二终端访问第一终端时的报文处理流程。需要说明的是，先描述步骤1613至步骤1615，再描述步骤1616至步骤1618，仅是为了表述方便，本实施例对步骤1613至步骤1615、步骤1616至步骤1618这两种过程不做时序上的限定。
1613、第一终端将报文发送至执行节点。
第一终端可以将本端的网络地址作为报文的源网络地址，将第二终端的网络地址作为报文的目的网络地址，根据源网络地址以及目的网络地址，生成待发送至第二终端的报文，将报文发送至执行节点。可选地，第一终端可以将报文发送至认证节点，认证节点可以接收第一终端发送的报文，将报文发送至执行节点。
1614、当执行节点接收第一终端的报文时，执行节点根据第一终端的报文携带的源网络地址，从第一安全组关联信息中，获取源网络地址对应的第一安全组，根据第一终端的报文携带的目的网络地址，从第二安全组关联信息中，获取目的网络地址对应的第二安全组。
1615、执行节点按照与源安全组为第一安全组、目的安全组为第二安全组的安全组策略，处理报文。
1616、第二终端将报文发送至执行节点。
第二终端可以将本端的网络地址作为报文的源网络地址，将第一终端的网络地址作为报文的目的网络地址，根据源网络地址以及目的网络地址，生成待发送至第一终端的报文，将报文发送至执行节点。可选地，第二终端可以将报文发送至认证节点，认证节点可以接收第二终端发送的报文，将报文发送至执行节点。
1617、当执行节点接收第二终端的报文时，执行节点根据第二终端的报文携带的源网络地址，从第二安全组关联信息中，获取源网络地址对应的第二安全组，根据第二终端的报文携带的目的网络地址，从第一安全组关联信息中，获取目的网络地址对应的第一安全组。
1618、执行节点按照源安全组为第二安全组、目的安全组为第一安全组的安全组策略，处理报文。
可选地，本申请实施例提供的方法可以应用于终端和网络资源之间互访的场景中，具体实现可以参见下述图17实施例至图19实施例。
为了与图14实施例至图16实施例区分描述，将图17实施例中的认证节点称为第三认证节点，将通过第三认证节点认证的终端称为第三终端，将第三终端所属的安全组称为第三安全组，将网络资源所属的安全组称为第四安全组，将接收到第三终端与网络资源之间传输的报文的执行节点称为第二目标执行节点。
图17是本申请实施例提供的一种信息同步方法的流程图，如图17所示，该方法的执行主体为同步节点，包括以下步骤：
1701、同步节点接收第三认证节点发送的第三终端的第三安全组关联信息。
第三安全组关联信息用于指示第三终端的网络地址与第三终端所属的第三安全组之间的映射关系。例如，第三安全组关联信息可以包括第三终端的网络地址以及第三安全组的组标识。第三安全组关联信息可以在第三认证节点对第三终端认证的过程中生成。
具体地，第三认证节点对第三终端认证的过程可以包括：第三认证节点接收第三终端的认证请求，第三认证节点对第三终端进行认证，得到第三终端所属的第三安全组；根据第三终端的网络地址以及第三安全组，获取第三终端的第三安全组关联信息；将第三安全组关联信息发送至同步节点。其中，该过程可以参见上述图9实施例，在此不做赘述。
可选地，如果第三安全组关联信息进行了编码，则同步节点可以接收编码后的第三安全组关联信息；对编码后的第三安全组关联信息进行解码，得到第三安全组关联信息；
可选地，如果第三安全组关联信息进行了压缩，则同步节点可以接收压缩后的安全组关联信息；对压缩后的第三安全组关联信息进行解压缩，得到第三安全组关联信息。
1702、同步节点确定包括第二目标执行节点的至少一个执行节点，第二目标执行节点用于按照安全组策略处理第三终端与网络资源之间传输的报文。
可选地，同步节点确定至少一个执行节点的过程可以包括下述实现方式一至实现方式二：
实现方式一、同步节点确定第二目标执行节点。
可选地，实现方式一可以包括：同步节点根据第三终端的网络地址所属的第三目标网段，从网段与执行节点之间的对应关系中，获取第三目标网段对应的第二目标执行节点。其中，第三目标网段是指第三终端的网络地址所属的网段。
实现方式二、确定网络中的每个执行节点。
可选地，同步节点可以按照结构化数据格式，对第三安全组关联信息进行编码，得到编码后的第三安全组关联信息。
可选地，同步节点可以对第三安全组关联信息进行压缩，得到压缩后的第三安全组关联信息。
1703、同步节点将第三安全组关联信息发送至至少一个执行节点。
步骤1704可以与上述图9实施例中的903同理，在此不做赘述。
可选地，同步节点可以将编码后的第三安全组关联信息发送至至少一个执行节点。可选地，同步节点可以将压缩后的第三安全组关联信息发送至至少一个执行节点。
本实施例提供的方法，同步节点通过将第三终端的第三安全组关联信息同步至执行节点，可以让执行节点持有从第三认证节点认证的第三终端的安全组关联信息，以使执行节点能够感知第三终端所属的第三安全组，那么当执行节点接收到第三终端与网络资源之间传输的报文时，可以按照第三终端与网络资源所属的第三安全组匹配的安全组策略处理报文，能够对第三终端与网络资源之间互访的权限进行控制。
图18是本申请实施例提供的一种报文处理方法的流程图，如图18所示，该方法的执行主体可以为执行节点，包括以下步骤：
1801、执行节点接收同步节点发送的第三终端的第三安全组关联信息。
步骤1801可以与上述图12实施例中的1201同理，在此不做赘述。
可选地，如果第三安全组关联信息进行了编码，则执行节点可以接收编码后的第三安全组关联信息；对编码后的第三安全组关联信息进行解码，得到第三安全组关联信息。
可选地，如果第三安全组关联信息进行了压缩，则执行节点可以接收压缩后的第三安全组关联信息；对压缩后的第三安全组关联信息进行解压缩，得到第三安全组关联信息。
1802、执行节点接收第三终端与网络资源之间传输的报文。
第三终端与网络资源之间传输的报文可以包括第三终端向网络资源发送的报文以及网络资源向第三终端发送的报文中的至少一项。
对于第三终端向网络资源发送的报文来说，报文的源网络地址可以为第三终端的网络地址，报文的 目的网络地址可以为网络资源的网络地址；相应地，步骤1802可以包括：执行节点接收到第三终端发送的、待发送至网络资源的报文。
对于网络资源向第三终端发送的报文来说，报文的源网络地址可以为网络资源的网络地址，报文的目的网络地址可以为第三终端的网络地址。步骤1802可以包括：执行节点接收到网络资源发送的、待发送至第三终端的报文。
1803、执行节点从第三安全组关联信息中，获取第三终端的网络地址对应的第三安全组，从配置信息中，获取网络资源的网络地址对应的第四安全组。
通过执行步骤1802，执行节点得到了通过第三认证节点认证的第三终端的安全组关联信息，另外执行节点可以预先存储配置信息，当第三终端与网络资源之间传输的报文到达执行节点时，执行节点可以通过第三终端以及网络资源的安全组关联信息，控制第三终端与网络资源之间的互访权限。
配置信息用于指示网络资源所属的安全组，该配置信息可以包括至少一个网络资源的网络地址以及至少一个安全组的组标识。例如，配置信息可以如下表6所示。执行节点可以网络资源的网络地址，查询配置信息，得到网络资源对应的安全组，即第四安全组。该配置信息可以通过配置指令生成。例如在部署阶段，管理员可以在授权节点上触发配置操作，授权节点可以接收配置指令，根据配置指令生成配置信息，将配置信息发送至执行节点。当然，执行节点也可以向授权节点发送查询请求，以便从授权节点获取配置信息，本实施例对执行节点获取配置信息的方式不做限定。
表6
网络资源的网络地址 安全组的组标识
202.178.100.1 100
202.178.100.2 200
202.178.100.3 300
如果报文为第三终端向网络资源发送的报文，则步骤1804可以包括下述(1.1)和(1.2)。
(1.1)根据报文携带的源网络地址，从第三安全组关联信息中，获取源网络地址对应的第三安全组。具体地，如果报文的源网络地址为第三终端的网络地址，则根据第三终端的网络地址以及第三终端的第三安全组关联信息，即可确定第三终端所属的第三安全组。
(1.2)根据报文携带的目的网络地址，从第四安全组关联信息，获取目的网络地址对应的第四安全组，目的网络地址为网络资源的网络地址。具体地，如果报文的目的网络地址为网络资源的网络地址，则根据网络资源的网络地址以及配置信息，即可确定网络资源所属的第四安全组。
如果报文为网络资源向第三终端发送的报文，则步骤1804可以包括下述(2.1)和(2.2)。
(2.1)根据报文携带的源网络地址，从第四安全组关联信息中，获取源网络地址对应的第四安全组。具体地，如果报文的源网络地址为网络资源的网络地址，则根据网络资源的网络地址以及配置信息，即可确定网络资源所属的第四安全组。
(2.2)根据报文携带的目的网络地址，从第三安全组关联信息，获取目的网络地址对应的第三安全组。具体地，如果报文的目的网络地址为第三终端的网络地址，则根据第三终端的网络地址以及第三终端的第三安全组关联信息，即可确定第三终端所属的第三安全组。
1804、执行节点按照与第三终端的第三安全组匹配、且与网络资源所属的第四安全组匹配的安全组策略，处理报文。
可选地，执行节点可以根据第三终端所属的第三安全组以及网络资源所属的第四安全组，匹配第三安全组以及第四安全组对应的安全组策略。在一种可能的实现中，执行节点可以根据第三终端所属的第三安全组以及网络资源所属的第四安全组，从安全组与安全组策略之间的对应关系中，得到第三安全组 以及第四安全组对应的安全组策略。其中，安全组与安全组策略之间的对应关系的描述请参见上述图12实施例中的1204，在此不做赘述。
关于根据安全组与安全组策略之间的对应关系匹配安全组策略的方式，假设源安全组为第三安全组、目的安全组为第四安全组的安全组策略称为第三安全组策略，源安全组为第四安全组、目的安全组为第三安全组的安全组策略称为第四安全组策略，匹配安全组策略的方式可以参见下述情况一以及情况二：
情况一、如果报文为第三终端向网络资源发送的报文，则匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取第三安全组策略。
情况二、如果报文为网络资源向第三终端发送的报文，则匹配安全组策略的方式可以包括：从安全组与安全组策略之间的对应关系中，获取第四安全组策略。。
可选地，第三安全组策略与第四安全组策略可以不同。如此，对第三终端向网络资源发送的报文的处理方式、对网络资源向第三终端发送的报文的处理方式可以不同。具体来讲，可以包括下述实现(1)以及实现(2)中的任一项或多项。
实现(1)第三安全组策略中的访问权限控制策略与第四安全组策略中的访问权限控制策略可以不同，从而实现第三终端访问网络资源的权限与网络资源访问第三终端的权限不同的功能，例如可以允许第三终端访问网络资源，禁止网络资源访问第三终端。在一个示例性场景中，可以允许管理员的终端访问弹性云服务器，禁止弹性云服务器访问管理员的终端。
实现(2)第三安全组策略中的体验保证策略与第四安全组策略中的体验保证策略可以不同，从而实现第三终端访问网络资源的服务质量与网络资源访问第三终端的服务质量不同的功能，例如可以高优先转发第三终端访问网络资源的报文，低优先转发网络资源访问第三终端的报文。
当然，第三安全组策略与第四安全组策略不同仅是可选方式，第三安全组策略与第四安全组策略也可以相同，本实施例对此不做限定。
本实施例提供的方法，执行节点通过接收同步节点发送的第三终端的第三安全组关联信息，可以持有从认证节点认证的终端的安全组关联信息，从而能够感知终端所属的安全组，那么当执行节点接收到终端与网络资源之间传输的报文时，可以按照与终端所属的安全组以及网络资源所属的安全组匹配的安全组策略，处理报文，从而能够对终端与网络资源之间互访的权限进行控制。
图19是本申请实施例提供的一种业务处理方法的流程图，如图19所示，交互主体包括认证节点、第三终端、同步节点、执行节点，包括以下步骤：
1901、第三终端向第三认证节点发送认证请求。
1902、当第三认证节点接收第三终端的认证请求时，第三认证节点对第三终端进行认证，得到第三终端所属的第三安全组。
1903、第三认证节点根据第三终端的网络地址以及第三安全组，获取第三终端的第三安全组关联信息。
1904、第三认证节点将第三安全组关联信息发送至同步节点。
1905、当同步节点接收认证节点发送的第三终端的第三第三安全组关联信息时，同步节点确定包括目标执行节点的至少一个执行节点，目标执行节点用于按照第三安全组策略处理终端的报文。
1906、同步节点将第三安全组关联信息发送至至少一个执行节点。
1907、执行节点接收同步节点发送的第三终端的第三安全组关联信息。
1908、第三终端将第三终端与网络资源之间传输的报文发送至执行节点。
1909、当执行节点接收第三终端与网络资源之间传输的报文时，执行节点根据报文携带的网络地址， 从第三安全组关联信息中，获取网络地址对应的第三安全组。
1910、执行节点按照与第三安全组匹配、且与网络资源所属的第四安全组匹配的第三安全组策略，处理报文。
可选地，本申请实施例提供的方法可以应用于授权设备支持目标功能的场景中，该目标功能为将安全组关联信息发送至同步节点的功能，具体实现可以如下述图20实施例所示。
图20是本申请实施例提供的一种业务处理方法的流程图，如图20所示，该方法的交互主体包括第一授权设备，终端、同步节点、执行节点，包括以下步骤：
2001、终端向第一授权设备发送认证请求。
第一授权设备为支持目标功能的授权设备。例如，第一授权设备可以支持将安全组关联信息发送至认证节点，也支持将安全组关联信息还发送至认证节点以外的其他设备。举例来说，第一授权设备可以为自研设备。例如，第一授权设备可以为自研AAA服务器。
2002、当第一授权设备接收终端的认证请求时，第一授权设备对终端进行认证，得到终端所属的安全组。
步骤2002与上述图9实施例中的步骤901至步骤902同理，在此不做过多赘述。
2003、第一授权设备根据终端的网络地址以及安全组，获取终端的安全组关联信息。
步骤2003与上述图9实施例中的步骤903同理，在此不做过多赘述。
可选地，在将安全组关联信息发送至同步节点之前，第一授权设备可以按照结构化数据格式，对安全组关联信息进行编码，得到编码后的安全组关联信息。
可选地，将安全组关联信息发送至同步节点之前，第一授权设备可以对安全组关联信息进行压缩，得到压缩后的安全组关联信息。
2004、第一授权设备将安全组关联信息发送至同步节点。
步骤2004与上述图9实施例中的步骤904同理，在此不做过多赘述。
可选地，如果第一授权设备在步骤2004中，按照结构化数据格式，对安全组关联信息进行编码，则本步骤可以包括：第一授权设备将编码后的安全组关联信息发送至同步节点。
可选地，如果第一授权设备在步骤2004中，对安全组关联信息进行压缩，则本步骤可以包括：第一授权设备将压缩后的安全组关联信息发送至同步节点。
2005、同步节点接收第一授权设备发送的终端的安全组关联信息。
步骤2005可以与上述图10实施例中的1001同理，在此不做过多赘述。
2006、同步节点确定包括目标执行节点的至少一个执行节点，目标执行节点用于按照安全组策略处理终端的报文。
步骤2006可以与上述图10实施例中的步骤1001至1002同理，在此不做过多赘述。
2007、同步节点将安全组关联信息发送至至少一个执行节点。
步骤2007可以与上述图10实施例中的1003同理，在此不做过多赘述。
2008、执行节点接收同步节点发送的终端的安全组关联信息。
步骤2008可以与上述图12实施例中的1201同理，在此不做过多赘述。
2009、终端将报文发送至执行节点。
2010、当执行节点接收终端的报文时，执行节点根据报文携带的网络地址，从安全组关联信息中，获取网络地址对应的安全组。
步骤2010可以与上述图12实施例中的1202至步骤1203同理，在此不做过多赘述。
2011、执行节点按照安全组匹配的安全组策略，处理报文。
步骤2011可以与上述图12实施例中的1204同理，在此不做过多赘述。
可选地，本申请实施例提供的方法也可以应用于授权设备不支持目标功能的场景，具体实现可以如下述图21实施例所示。
图21是本申请实施例提供的一种业务处理方法的流程图，如图21所示，该方法的交互主体包括认证点设备，第二授权设备，终端、同步节点、执行节点，包括以下步骤：
2101、终端向第二授权设备发送认证请求。
第二授权设备为不支持目标功能的授权设备。举例来说，第二授权设备可以为第三方设备。例如，第二授权设备可以为第三方AAA服务器。
2102、当第二授权设备接收终端的认证请求时，第二授权设备对终端进行认证，得到终端所属的安全组。
步骤2102与上述图9实施例中的步骤901至步骤902同理，在此不做过多赘述。
2103、第二授权设备根据终端的网络地址以及安全组，获取终端的安全组关联信息。
步骤2103与上述图9实施例中的步骤903同理，在此不做过多赘述。
可选地，在将安全组关联信息发送至同步节点之前，第二授权设备可以按照结构化数据格式，对安全组关联信息进行编码。
可选地，将安全组关联信息发送至同步节点之前，第二授权设备可以对安全组关联信息进行压缩。
2104、第二授权设备将安全组关联信息发送至认证点设备。
步骤2104与上述图9实施例中的步骤904同理，在此不做过多赘述。
可选地，如果第二授权设备在步骤2104中，按照结构化数据格式，对安全组关联信息进行编码，则本步骤可以包括：第二授权设备将编码后的安全组关联信息发送至认证点设备。
可选地，如果第二授权设备在步骤2104中，对安全组关联信息进行压缩，则本步骤可以包括：第二授权设备将压缩后的安全组关联信息发送至认证点设备。
2105、认证点设备接收安全组关联信息。
步骤2105可以与上述图10实施例中的1001同理，在此不做过多赘述。
2106、认证点设备将安全组关联信息发送至同步节点。
步骤2106可以与上述图10实施例中的1002同理，在此不做过多赘述。
可选地，如果第二授权设备在步骤2104中，按照结构化数据格式，对安全组关联信息进行编码，则本步骤可以包括：认证点设备将编码后的安全组关联信息发送至同步节点。
可选地，如果第二授权设备在步骤2104中，对安全组关联信息进行压缩，则本步骤可以包括：认证点设备将压缩后的安全组关联信息发送至同步节点。
2107、同步节点接收认证点设备发送的终端的安全组关联信息。
步骤2107可以与上述图10实施例中的1001同理，在此不做过多赘述。
2108、同步节点确定包括目标执行节点的至少一个执行节点，目标执行节点用于按照安全组策略处理终端的报文。
步骤2108可以与上述图10实施例中的1002同理，在此不做过多赘述。
2108、同步节点将安全组关联信息发送至至少一个执行节点。
2109、终端将报文发送至执行节点。
2110、当执行节点接收终端的报文时，执行节点根据报文携带的网络地址，从安全组关联信息中，获取网络地址对应的安全组。
步骤2110可以与上述图12实施例中的1202至步骤1203同理，在此不做过多赘述。
2111、执行节点按照安全组匹配的安全组策略，处理报文。
步骤2111可以与上述图12实施例中的1204同理，在此不做过多赘述。
本实施例提供的方法，第二授权设备通过将安全组关联信息发送至认证点设备，认证点设备将安全组关联信息上报给同步节点，由同步节点将安全组关联信息发送至执行节点，可在授权设备不支持目标功能的场景下，实现安全组关联信息的同步，可以打破第三方设备通常不支持向认证点设备以外的其他网络设备下发安全组关联信息的技术壁垒，从而实现支持和第三方设备对接的功能，提高网络的兼容性。
图22是本申请实施例提供的一种信息同步装置的结构示意图。参见图22，该信息同步装置包括：
接收模块2201，用于执行上述步骤1001、步骤1401、步骤1402、步骤1701、步骤2005、步骤2105中的任一项或多项；
确定模块2202，用于执行上述步骤1002、步骤1305、步骤1403、步骤1610、步骤1702、步骤1905、步骤2006、步骤2107中的任一项或多项；
发送模块2203，用于执行上述步骤1003、步骤1306、步骤1404、步骤1703、步骤1906、步骤2007、步骤2108中的任一项或多项。
可选地，该确定模块2202，用于执行上述步骤1002中的实现方式一、实现方式二中的任一项或多项。
可选地，该接收模块2201，还用于接收配置指令。
需要说明的第一点是：图22实施例该的各个模块具体可以是软件中执行相应功能的软件模块，即，“模块”可以是一组计算机程序构成的功能模块，该计算机程序可以是源程序或目标程序，该计算机程序可以通过任意编程语言实现。通过上述各个模块，计算机设备可以基于处理器加存储器的硬件来实现信息同步的功能，也即是，可以通过计算机设备的处理器，运行存储在计算机设备的存储器中的软件代码，来执行相应的软件来实现信息同步的功能。
需要说明的第二点是：图22实施例提供的信息同步装置在同步信息时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将信息同步装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的信息同步装置与信息同步方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
图23是本申请实施例提供的一种报文处理装置的结构示意图。参见图23，该报文处理装置包括：
接收模块2301，用于执行步骤1201、步骤1202、步骤1307、步骤1501、步骤1502、步骤1612、步骤1503、步骤1801、步骤1802、步骤1907、步骤2008中的任一项或多项；
获取模块2302，用于执行步骤1203、步骤1309、步骤1504、步骤1614、步骤1803、步骤1909、步骤2010中的任一项或多项；
处理模块2303，用于执行步骤1204、步骤1310、步骤1505、步骤1615、步骤1617、步骤1618、步骤1804、步骤1910、步骤2011中的任一项或多项。
需要说明的第一点是：图23实施例中的各个模块具体可以是软件中执行相应功能的软件模块，即，“模块”可以是一组计算机程序构成的功能模块，该计算机程序可以是源程序或目标程序，该计算机程序可以通过任意编程语言实现。通过上述各个模块，计算机设备可以基于处理器加存储器的硬件来实现报文处理的功能，也即是，可以通过计算机设备的处理器，运行存储在计算机设备的存储器中的软件代码，来执行相应的软件来实现报文处理的功能。
需要说明的第二点是：图23实施例提供的报文处理装置在处理报文时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将报文处理装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供 的报文处理装置与报文处理方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
图24是本申请实施例提供的一种认证装置的结构示意图。参见图24，该认证装置包括：
接收模块2401，用于执行步骤901、步骤1701、步骤2105中的任一项或多项；
认证模块2402，用于执行步骤902、步骤1302、步骤1602、步骤1602、步骤1902、步骤2002、步骤2102中的任一项或多项；
获取模块2403，用于执行步骤903、步骤1303、步骤1603、步骤1605、步骤1903、步骤2003、步骤2103中的任一项或多项；
发送模块2404，用于执行步骤904、步骤1304、步骤1604、步骤1607、步骤1904、步骤2004、步骤2104、步骤2106中的任一项或多项。
需要说明的第一点是：图24实施例中的各个模块具体可以是软件中执行相应功能的软件模块，即，“模块”可以是一组计算机程序构成的功能模块，该计算机程序可以是源程序或目标程序，该计算机程序可以通过任意编程语言实现。通过上述各个模块，计算机设备可以基于处理器加存储器的硬件来实现认证的功能，也即是，可以通过计算机设备的处理器，运行存储在计算机设备的存储器中的软件代码，来执行相应的软件来实现认证的功能。
需要说明的第二点是：图24实施例提供的认证装置在进行认证时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将认证装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的认证装置与认证方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
在一个示例性实施例中，本申请还提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得计算机设备能够实现上述实施例中信息同步方法所执行的操作。
在一个示例性实施例中，本申请还提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得计算机设备能够实现上述实施例中报文处理方法所执行的操作。
在一个示例性实施例中，本申请还提供了一种包含指令的计算机程序产品，当其在计算机设备上运行时，使得计算机设备能够实现上述实施例中认证方法所执行的操作。
在一个示例性实施例中，本申请还提供了一种业务处理系统，在一种可能的实现方式中，该系统包括：上述图22实施例中的信息同步装置、图23实施例中的报文处理装置和图24实施例中的认证装置。
在另一种可能的实现方式中，该系统包括：
上述方法实施例中的同步节点、执行节点以及认证节点。
在一个示例性实施例中，本申请还提供了一种芯片，该芯片包括处理器和/或程序指令，当该芯片运行时，实现上述实施例中信息同步方法所执行的操作。
在一个示例性实施例中，本申请还提供了一种芯片，该芯片包括处理器和/或程序指令，当该芯片运行时，实现上述实施例中报文处理方法所执行的操作。
在一个示例性实施例中，本申请还提供了一种芯片，该芯片包括处理器和/或程序指令，当该芯片运行时，实现上述实施例中认证方法所执行的操作。
上述所有可选技术方案，可以采用任意结合形成本申请的可选实施例，在此不再一一赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例该的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例 如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本申请中的字符“/”，一般表示前后关联对象是一种“或”的关系。
本申请中术语“多个”的含义是指两个或两个以上，例如，多个数据包是指两个或两个以上的数据包。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，本领域技术人员可以理解，“第一”“第二”等字样不对数量和执行顺序进行限定。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上该仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (22)

  1. 一种信息同步方法，其特征在于，所述方法包括：
    接收认证节点发送的终端的安全组关联信息，所述安全组关联信息用于指示所述终端的网络地址与所述终端所属的安全组之间的映射关系；
    确定包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文；
    将所述安全组关联信息发送至所述至少一个执行节点。
  2. 根据权利要求1所述的方法，其特征在于，所述确定包括目标执行节点的至少一个执行节点，包括：
    根据所述网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定所述目标网段对应的所述目标执行节点；或者，
    确定网络中的每个执行节点。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定所述目标网段对应的所述目标执行节点之前，所述方法还包括：
    接收配置指令，所述配置指令用于指示网段与执行节点之间的对应关系。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述接收认证节点发送的终端的安全组关联信息，包括：
    接收第一认证节点发送的第一终端的第一安全组关联信息，所述第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的第一安全组之间的映射关系；
    接收第二认证节点发送的第二终端的第二安全组关联信息，所述第二认证节点与所述第一认证节点不同，所述第二安全组关联信息用于指示所述第二终端的网络地址与所述第二终端所属的第二安全组之间的映射关系；
    相应地，所述确定包括目标执行节点的至少一个执行节点，包括：
    确定包括第一目标执行节点的至少一个执行节点，所述第一目标执行节点用于按照安全组策略处理所述第一终端与所述第二终端之间传输的报文。
  5. 根据权利要求1至3任一项所述的方法，其特征在于，所述接收认证节点发送的终端的安全组关联信息，包括：
    接收第三认证节点发送的第三终端的第三安全组关联信息，所述第三安全组关联信息用于指示所述第三终端的网络地址与所述第三终端所属的第三安全组之间的映射关系；
    相应地，所述确定包括目标执行节点的至少一个执行节点，包括：
    确定包括第二目标执行节点的至少一个执行节点，所述第二目标执行节点用于按照安全组策略处理所述第三终端与网络资源之间传输的报文。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述接收认证节点发送的终端的安全组关联信息，包括：
    接收授权设备发送的终端的安全组关联信息；或者，
    接收认证点设备发送的终端的安全组关联信息，所述终端的安全组关联信息由授权设备发送至所述认证点设备。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述方法还包括：
    接收所述认证节点发送的所述终端的更新后的安全组关联信息；
    将所述更新后的安全组关联信息发送至所述至少一个执行节点；
    其中，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述终端所属的更新后的安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述终端所属的更新后的安全组之间的映射关系。
  8. 一种认证方法，其特征在于，所述方法包括：
    接收终端的认证请求；
    对所述终端进行认证，得到所述终端所属的安全组；
    根据所述终端的网络地址以及所述安全组，获取所述终端的安全组关联信息，所述安全组关联信息用于指示所述网络地址与所述终端所属的安全组之间的映射关系；
    将所述安全组关联信息发送至同步节点，所述同步节点用于将所述安全组关联信息同步至包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文。
  9. 根据权利要求8所述的方法，其特征在于，所述将所述安全组关联信息发送至同步节点，包括：
    将所述安全组关联信息发送至认证点设备，所述安全组关联信息用于供所述认证点设备用于发送至所述同步节点。
  10. 根据权利要求8至9任一项所述的方法，其特征在于，所述方法还包括：
    获取所述终端的更新后的网络地址，根据所述更新后的网络地址以及所述安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述更新后的网络地址与所述安全组之间的映射关系，将所述更新后的安全组关联信息发送至所述同步节点；或者，
    获取所述终端所属的更新后的安全组，根据所述终端的网络地址以及所述更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述更新后的安全组之间的映射关系，将所述终端的更新后的安全组关联信息发送至所述同步节点；或者，
    获取所述终端更新后的网络地址以及所述终端所属的更新后的安全组，根据所述更新后的网络地址以及所述更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述更新后的网络地址与所述更新后的安全组之间的映射关系，将所述终端的更新后的安全组关联信息发送至所述同步节点。
  11. 一种信息同步装置，其特征在于，所述装置包括：
    接收模块，用于接收认证节点发送的终端的安全组关联信息，所述安全组关联信息用于指示所述终端的网络地址与所述终端所属的安全组之间的映射关系；
    确定模块，用于确定包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文；
    发送模块，用于将所述安全组关联信息发送至所述至少一个执行节点。
  12. 根据权利要求11所述的装置，其特征在于，所述确定模块，用于：根据所述网络地址所属的目标网段，从网段与执行节点之间的对应关系中，确定所述目标网段对应的所述目标执行节点；或者，确定网络中的每个执行节点。
  13. 根据权利要求12所述的装置，其特征在于，所述接收模块，还用于：接收配置指令，所述配置指令用于指示网段与执行节点之间的对应关系。
  14. 根据权利要求11至13任一项所述的装置，其特征在于，所述接收模块，用于：接收第一认证节点发送的第一终端的第一安全组关联信息，所述第一安全组关联信息用于指示所述第一终端的网络地址与所述第一终端所属的第一安全组之间的映射关系；接收第二认证节点发送的第二终端的第二安全组关联信息，所述第二认证节点与所述第一认证节点不同，所述第二安全组关联信息用于指示所述第二终 端的网络地址与所述第二终端所属的第二安全组之间的映射关系；
    相应地，所述确定模块，用于：确定包括第一目标执行节点的至少一个执行节点，所述第一目标执行节点用于按照安全组策略处理所述第一终端与所述第二终端之间传输的报文。
  15. 根据权利要求11至13任一项所述的装置，其特征在于，所述接收模块，用于：接收第三认证节点发送的第三终端的第三安全组关联信息，所述第三安全组关联信息用于指示所述第三终端的网络地址与所述第三终端所属的第三安全组之间的映射关系；
    相应地，所述确定模块，用于：确定包括第二目标执行节点的至少一个执行节点，所述第二目标执行节点用于按照安全组策略处理所述第三终端与网络资源之间传输的报文。
  16. 根据权利要求11至15任一项所述的装置，其特征在于，所述接收模块，用于：接收授权设备发送的终端的安全组关联信息；或者，接收认证点设备发送的终端的安全组关联信息，所述终端的安全组关联信息由授权设备发送至所述认证点设备。
  17. 根据权利要求11至16任一项所述的装置，其特征在于，所述接收模块，还用于：接收所述认证节点发送的所述终端的更新后的安全组关联信息；
    所述发送模块，还用于：将所述更新后的安全组关联信息发送至所述至少一个执行节点；
    其中，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述终端所属的更新后的安全组之间的映射关系，或者，所述更新后的安全组关联信息用于指示所述终端的更新后的网络地址与所述终端所属的更新后的安全组之间的映射关系。
  18. 一种认证装置，其特征在于，所述装置包括：
    接收模块，用于接收终端的认证请求；
    认证模块，用于对所述终端进行认证，得到所述终端所属的安全组；
    获取模块，用于根据所述终端的网络地址以及所述安全组，获取所述终端的安全组关联信息，所述安全组关联信息用于指示所述网络地址与所述终端所属的安全组之间的映射关系；
    发送模块，用于将所述安全组关联信息发送至同步节点，所述同步节点用于将所述安全组关联信息同步至包括目标执行节点的至少一个执行节点，所述目标执行节点用于按照安全组策略处理所述终端的报文。
  19. 根据权利要求18所述的装置，其特征在于，所述发送模块，用于：将所述安全组关联信息发送至认证点设备，所述安全组关联信息用于供所述认证点设备用于发送至所述同步节点。
  20. 根据权利要求18至19任一项所述的装置，其特征在于，
    所述获取模块，还用于：获取所述终端的更新后的网络地址，根据所述更新后的网络地址以及所述安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述更新后的网络地址与所述安全组之间的映射关系；或者，
    所述获取模块，还用于：获取所述终端所属的更新后的安全组，根据所述终端的网络地址以及所述更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述终端的网络地址与所述更新后的安全组之间的映射关系；或者，
    所述获取模块，还用于：获取所述终端更新后的网络地址以及所述终端所属的更新后的安全组，根据所述更新后的网络地址以及所述更新后的安全组，获取所述终端的更新后的安全组关联信息，所述更新后的安全组关联信息用于指示所述更新后的网络地址与所述更新后的安全组之间的映射关系；
    所述发送模块，用于：将所述终端的更新后的安全组关联信息发送至所述同步节点。
  21. 一种计算机设备，其特征在于，所述计算机设备包括处理器和存储器，所述存储器中存储有至 少一条指令，所述指令由所述处理器加载并执行以实现如权利要求1至权利要求7任一项所述的信息同步方法所执行的操作，或者如权利要求8至权利要求10任一项所述的认证方法所执行的操作。
  22. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现如权利要求1至权利要求7任一项所述的信息同步方法所执行的操作，或者如权利要求8至权利要求10任一项所述的认证方法所执行的操作。
PCT/CN2019/122252 2018-12-04 2019-11-30 信息同步方法、认证方法及装置 WO2020114336A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19893018.2A EP3817272A4 (en) 2018-12-04 2019-11-30 INFORMATION SYNCHRONIZATION METHOD, AUTHENTICATION METHOD AND DEVICE
US17/160,551 US20210185039A1 (en) 2018-12-04 2021-01-28 Information synchronization method, authentication method, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811476240.3 2018-12-04
CN201811476240.3A CN111277543B (zh) 2018-12-04 2018-12-04 信息同步方法、认证方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/160,551 Continuation US20210185039A1 (en) 2018-12-04 2021-01-28 Information synchronization method, authentication method, and apparatus

Publications (1)

Publication Number Publication Date
WO2020114336A1 true WO2020114336A1 (zh) 2020-06-11

Family

ID=70975187

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/122252 WO2020114336A1 (zh) 2018-12-04 2019-11-30 信息同步方法、认证方法及装置

Country Status (4)

Country Link
US (1) US20210185039A1 (zh)
EP (1) EP3817272A4 (zh)
CN (1) CN111277543B (zh)
WO (1) WO2020114336A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112445658A (zh) * 2020-10-30 2021-03-05 深圳云天励飞技术股份有限公司 信息同步方法及相关设备
CN113965343A (zh) * 2021-09-06 2022-01-21 锐捷网络股份有限公司 一种基于局域网的终端设备隔离方法及装置
CN114786177A (zh) * 2022-04-07 2022-07-22 武汉联影医疗科技有限公司 边缘节点接入处理方法、移动终端和边缘节点
US11405426B2 (en) * 2019-11-04 2022-08-02 Salesforce.Com, Inc. Comparing network security specifications for a network to implement a network security policy for the network

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112468384B (zh) * 2020-11-24 2022-04-22 新华三技术有限公司 通信方法、装置、交换机、ap及ac
CN112507329B (zh) * 2020-12-11 2024-07-23 海信电子科技(武汉)有限公司 安全防护方法及装置
CN115225300A (zh) * 2021-04-21 2022-10-21 华为技术有限公司 一种访问控制方法和相关设备
US11601395B1 (en) * 2021-12-22 2023-03-07 Uab 360 It Updating parameters in a mesh network
US11785089B2 (en) * 2021-12-28 2023-10-10 Uab 360 It Updating communication parameters in a mesh network
US11805100B2 (en) * 2021-12-29 2023-10-31 Uab 360 It Access control in a mesh network
US11658981B1 (en) * 2022-04-29 2023-05-23 Franklin Technology Inc. Internet access management service server capable of providing internet access management service based on terminal grouping and operating method thereof
CN117412370A (zh) * 2022-07-08 2024-01-16 大唐移动通信设备有限公司 同步传输组确定方法、终端及核心网网元

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104639512A (zh) * 2013-11-14 2015-05-20 华为技术有限公司 网络安全方法和设备

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7877796B2 (en) * 2004-11-16 2011-01-25 Cisco Technology, Inc. Method and apparatus for best effort propagation of security group information
CN101340625B (zh) * 2007-07-06 2012-04-04 华为技术有限公司 业务指南分组的方法、服务器以及系统
US7840708B2 (en) * 2007-08-13 2010-11-23 Cisco Technology, Inc. Method and system for the assignment of security group information using a proxy
KR101416233B1 (ko) * 2007-10-09 2014-08-06 삼성전자주식회사 방송 데이터 전송 방법과 전송 장치
KR101467784B1 (ko) * 2008-01-09 2014-12-03 엘지전자 주식회사 이기종망간 핸드오버시 선인증 수행방법
EP2425644B1 (en) * 2009-05-01 2017-11-22 Nokia Technologies Oy Systems, methods, and apparatuses for facilitating authorization of a roaming mobile terminal
US9326145B2 (en) * 2012-12-16 2016-04-26 Aruba Networks, Inc. System and method for application usage controls through policy enforcement
CN103718527B (zh) * 2013-03-30 2017-01-18 华为技术有限公司 一种通信安全处理方法、装置及系统
US9380025B2 (en) * 2013-07-03 2016-06-28 Cisco Technology, Inc. Method and apparatus for ingress filtering
US9917860B2 (en) * 2015-01-16 2018-03-13 Sri International Visually intuitive interactive network cyber defense
EP3116196A1 (en) * 2015-07-06 2017-01-11 Tridonic GmbH & Co KG Secure group communication
US11159486B2 (en) * 2015-11-17 2021-10-26 Zscaler, Inc. Stream scanner for identifying signature matches
US10382208B2 (en) * 2016-04-29 2019-08-13 Olympus Sky Technologies, S.A. Secure communications using organically derived synchronized processes
CN110476448B (zh) * 2017-04-17 2023-10-10 苹果公司 用于大规模物联网设备的基于组的上下文和安全性
US10798061B2 (en) * 2018-03-26 2020-10-06 Fortinet, Inc. Automated learning of externally defined network assets by a network security device
CN108809969B (zh) * 2018-05-30 2020-11-06 新华三技术有限公司 一种认证方法、系统及其装置

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104639512A (zh) * 2013-11-14 2015-05-20 华为技术有限公司 网络安全方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3817272A4

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11405426B2 (en) * 2019-11-04 2022-08-02 Salesforce.Com, Inc. Comparing network security specifications for a network to implement a network security policy for the network
US11716358B2 (en) 2019-11-04 2023-08-01 Salesforce, Inc. Comparing network security specifications for a network
CN112445658A (zh) * 2020-10-30 2021-03-05 深圳云天励飞技术股份有限公司 信息同步方法及相关设备
CN113965343A (zh) * 2021-09-06 2022-01-21 锐捷网络股份有限公司 一种基于局域网的终端设备隔离方法及装置
CN114786177A (zh) * 2022-04-07 2022-07-22 武汉联影医疗科技有限公司 边缘节点接入处理方法、移动终端和边缘节点
CN114786177B (zh) * 2022-04-07 2023-05-30 武汉联影医疗科技有限公司 边缘节点接入处理方法、移动终端和边缘节点

Also Published As

Publication number Publication date
US20210185039A1 (en) 2021-06-17
CN111277543B (zh) 2022-08-26
CN111277543A (zh) 2020-06-12
EP3817272A4 (en) 2021-11-24
EP3817272A1 (en) 2021-05-05

Similar Documents

Publication Publication Date Title
WO2020114336A1 (zh) 信息同步方法、认证方法及装置
US20220166846A1 (en) Technologies for managing sensor and telemetry data on an edge networking platform
US10084711B2 (en) High-performance quality-of-service packet scheduling for multiple packet processing engines
US10084647B2 (en) Data forwarding to server via virtual network card or to external network via network interface, based on fusion descriptor
US9065701B2 (en) Enhanced serialization mechanism
US10447591B2 (en) Executing multiple virtual private network (VPN) endpoints associated with an endpoint pool address
WO2014101777A1 (zh) 流表匹配方法和装置以及交换机
WO2017177767A1 (zh) 一种业务访问及其控制方法、装置
US20170034820A1 (en) Bandwidth control method and bandwidth control device
CN106878199B (zh) 一种接入信息的配置方法和装置
US11943203B2 (en) Virtual network replication using staggered encryption
US20120324090A1 (en) Resource control method, apparatus, and system in peer-to-peer network
KR20160122992A (ko) 정책 기반으로 네트워크 간에 연결성을 제공하기 위한 네트워크 통합 관리 방법 및 장치
EP3417367B1 (en) Implementing a storage system using a personal user device and a data distribution device
CN116436838A (zh) 网络接入控制器和方法
CN110798437B (zh) 一种数据保护方法、装置及计算机存储介质
US9015438B2 (en) System and method for achieving enhanced performance with multiple networking central processing unit (CPU) cores
US20150049604A1 (en) Efficient In-Band Communication of Quality-Of-Service Policies Between Virtual Classification Devices and Enforcement Devices
KR102474855B1 (ko) 메신저 서비스를 제공하기 위한 방법, 시스템 및 비일시성의 컴퓨터 판독 가능한 기록 매체
US11917407B2 (en) Key matching for EAPOL handshake using distributed computing
CN108111461B (zh) 实现虚拟机访问管理网络的方法、装置、网关及系统
WO2022110836A1 (zh) 通信的方法及通信装置
CN116781764A (zh) 长连接的任务执行方法、装置及相关设备
WO2016082363A1 (zh) 用户数据管理方法及装置
US20180115553A1 (en) Transparent asynchronous network flow information exchange

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19893018

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019893018

Country of ref document: EP

Effective date: 20210127

NENP Non-entry into the national phase

Ref country code: DE