WO2020248367A1 - Network connection method and related apparatus - Google Patents

Abstract

The embodiments of the present application are applicable to access control in security protection. Disclosed are a network connection method and a related apparatus. The method comprises: an intranet firewall allocation device acquiring planned trip information of a mobile wireless access device accessing a target intranet; the intranet firewall allocation device determining a first intranet firewall allocated to the mobile wireless access device; and when determining that a trip node condition is met, the intranet firewall allocation device sending a first IP address of the first intranet firewall to the mobile wireless access device in order to cause the mobile wireless access device to establish a connection with the first intranet firewall and to cut off a connection with a second intranet firewall, thereby realizing the switching of the intranet firewalls connected to the mobile wireless access device. By means of the present application, connected intranet firewalls can be recommended to and switched for a mobile wireless access device according to planned trip information of the mobile wireless access device, thereby ensuring the network quality when a user accesses a target intranet.

Description

Network connection method and related device

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 10, 2019, the application number is 2019104989754, and the application name is "a method for accessing an intranet and related devices", the entire content of which is incorporated herein by reference Applying.

Technical field

This application relates to the field of communications, and in particular to a network connection method and related devices.

Background technique

With the integration of the global economy, more and more companies have carried out related businesses all over the world, which requires company employees to be dispatched to work around the world. In some office scenarios, employees of an enterprise need to access some resources of the company’s intranet server when they travel abroad, such as accessing corporate intranet web pages, accessing files stored in shared folders in the intranet file server, etc. This requires providing a A method for traveling employees to access the corporate intranet.

Application content

This application provides a network connection method and related equipment. Through this application, it is possible to recommend switching the connected intranet firewall for the mobile wireless access device according to the planned itinerary information of the mobile wireless access device, ensuring that the user performs the target intranet The quality of the network accessed.

The first aspect of the embodiments of the present application provides a network connection method, including:

The intranet firewall distribution device obtains the planned itinerary information for the mobile wireless access device to access the target intranet, where the planned itinerary information includes the itinerary information of at least one planned itinerary node of the mobile wireless access device, wherein the plan The itinerary information of the itinerary node includes the planned travel time and the corresponding planned travel location;

The intranet firewall distribution device determines a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, where the first intranet firewall is the mobile An intranet firewall matched by the wireless access device when it reaches the planned trip node;

When the intranet firewall distribution device determines that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information according to the access device status information of the mobile wireless access device, The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects Open the connection with the second intranet firewall, which is for the intranet firewall distribution device to obtain the planned itinerary information of the mobile wireless access device according to the information sent by the mobile wireless access device. For the intranet access request of the target intranet, the intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.

The second aspect of the embodiments of the present application provides a network connection method, including:

The mobile wireless access device sends the planned itinerary information for accessing the target intranet to the intranet firewall distribution device, so that the intranet firewall distribution device selects from multiple intranets deployed for the target intranet according to the planned itinerary information. A first intranet firewall is determined in the network firewall, and the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned itinerary node, wherein the planned itinerary information includes Travel information of at least one planned travel node of the mobile wireless access device, where the travel information of the planned travel node includes the planned travel time and the corresponding planned travel location;

The mobile wireless access device receives the first IP address of the first intranet firewall, where the first IP address is that the intranet firewall assigns the device according to the access device status information of the mobile wireless access device , Sending it to the mobile wireless access device when it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information;

The mobile wireless access device sends a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall communicates with the mobile wireless access device according to the firewall connection request. establish connection;

The mobile wireless access device disconnects from a second intranet firewall, and the second intranet firewall means that before the mobile wireless access device sends the planned itinerary information to the intranet firewall distribution device, According to the intranet connection request for the target intranet sent by the mobile wireless access device, the intranet firewall distribution device determines the mobile from among the multiple intranet firewalls deployed for the target intranet. A firewall that matches the wireless access device.

The third aspect of the embodiments of the present application provides an intranet firewall distribution device, including:

The itinerary information acquiring unit is configured to acquire planned itinerary information for the mobile wireless access device to access the target intranet, where the planned itinerary information includes the itinerary information of at least one planned itinerary node of the mobile wireless access device, where all The itinerary information of the planned itinerary node includes the planned travel time and the corresponding planned travel location;

The first intranet firewall determining unit is configured to determine a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, where the first intranet firewall is An intranet firewall that matches when the mobile wireless access device reaches the planned trip node;

The IP address sending unit is configured to, according to the access device status information of the mobile wireless access device, determine that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information, and set all The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects Open the connection with the second intranet firewall, which is for the intranet firewall distribution device to obtain the planned itinerary information of the mobile wireless access device according to the information sent by the mobile wireless access device. For the intranet access request of the target intranet, the intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.

The fourth aspect of the embodiments of the present application provides a mobile wireless access device, including:

The itinerary sending unit is configured to send the planned itinerary information for accessing the target intranet to the intranet firewall distribution device, so that the intranet firewall distribution device selects the information about the planned itinerary from a plurality of A first intranet firewall is determined in the intranet firewall, and the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned itinerary node, wherein the planned itinerary information Including itinerary information of at least one planned itinerary node of the mobile wireless access device, where the itinerary information of the planned itinerary node includes the planned travel time and the corresponding planned travel location;

The address receiving unit is configured to receive a first IP address of the first intranet firewall, where the first IP address is that the intranet firewall allocation device is based on the access device status information of the mobile wireless access device, Sent to the mobile wireless access device when it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information;

The firewall connection unit is configured to send a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall establishes with the mobile wireless access device according to the firewall connection request connection;

The firewall connection unit is further configured to disconnect the connection with a second intranet firewall for the mobile wireless access device sending the planned itinerary information to the intranet firewall distribution device Previously, the intranet firewall allocation device determined the intranet firewall from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request sent by the mobile wireless access device for the target intranet. Mobile wireless access device matching firewall.

The fifth aspect of the embodiments of the present application provides a mobile wireless access device, including a processor, a memory, and a communication interface. The processor, the memory, and the communication interface are connected to each other, wherein the communication interface is used to receive and send data. The memory is used for storing program code, and the processor is used for calling the program code, and when the program code is executed by a computer, the computer executes the method of the second aspect.

The sixth aspect of the embodiments of the present application provides a computer non-volatile readable storage medium, the computer non-volatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions are When executed by a computer, the computer executes the method of the first aspect or the second aspect.

Through this application, it is realized that the mobile wireless access device is recommended to switch the connected intranet firewall to the mobile wireless access device according to the planned itinerary information of the mobile wireless access device, which ensures that the user uses the user terminal to connect to the intranet firewall through the mobile wireless access device The network quality of the target intranet access.

Description of the drawings

FIG. 1 is a schematic diagram of a framework of an intranet access system provided by an embodiment of this application;

2 is a schematic diagram of system interaction of a network connection method provided by an embodiment of this application;

3 is a schematic diagram of system interaction of another network connection method provided by an embodiment of the application;

FIG. 4 is a schematic structural diagram of a mobile wireless access device provided by an embodiment of this application;

FIG. 5 is a schematic structural diagram of an intranet firewall distribution device provided by an embodiment of the application;

Fig. 6 is a schematic structural diagram of another mobile wireless access device provided by an embodiment of the application.

Detailed ways

In the following, the network connection method and related devices provided by the embodiments of the present application will be described with reference to FIGS. 1 to 5.

Figure 1 is a schematic diagram of the framework of an intranet access system provided by an embodiment of the application. As shown in the figure, in the framework of the intranet access system, the intranet firewall 1, the intranet firewall 2, and the intranet firewall 3 are targeted Three intranet firewalls deployed in the intranet, mobile wireless access device 1 and mobile wireless access device 2 are respectively connected to the intranet firewall 1, the mobile wireless access device 3 is connected to the intranet firewall 3, and the user terminal 1 and The mobile wireless access device 2 is connected, and the user terminal 2 is connected with the mobile wireless access device.

Here, the target intranet is a local communication network that interconnects various computers, servers, and databases in a local geographic area of a specific enterprise, a specific institution, a specific school, etc. When the terminal or server in the target intranet communicates with the terminal or server in the target intranet, it is realized through the data link layer, and the communication message does not need to be routed through the router; in the terminal or server outside the target intranet When communicating, it is achieved through the network layer. The communication message sent by the terminal or server in the target intranet needs to be routed to the terminal or server outside the target intranet, the terminal or the terminal outside the target intranet, and The communication message returned by the server needs to be routed to the terminal or server on the target intranet after the router undergoes network address translation.

Here, the intranet firewall deployed for the target intranet can be a firewall deployed around the world that filters data packets entering and leaving the target intranet. The intranet firewall is connected to the router of the target intranet through the WAN, and then passes through the target intranet. The router realizes the connection to the intranet server of the target intranet.

Here, the mobile wireless access device is a mobile wireless access device that can transmit wireless network signals and has a routing function. The mobile wireless access device will access the data network by inserting a SIM (Subscriber Identification Module) card. It can also access a wired network by inserting a network cable, and can also access a wireless network by connecting to WIFI. The user terminal can access the wireless network transmitted by the mobile wireless access device to connect with the mobile wireless access device.

Here, the intranet firewall distribution device may be a device that has a domain name resolution function for the target intranet, and stores the IP addresses and deployment locations of each firewall deployed for the target intranet, such as GTM (Global Traffic Manager, global traffic management) Equipment etc.

Here, the user terminal may be a terminal device with a wireless network receiving function, such as a notebook computer, a mobile phone, and a tablet computer.

Refer to FIG. 2, which is a schematic diagram of system interaction of a network connection method provided by an embodiment of the application. As shown in the figure, the method may include steps S201 to S205:

S201: The mobile wireless access device sends the planned itinerary information for accessing the target intranet to the intranet firewall distribution device.

Here, the planned itinerary information for accessing the target intranet is the itinerary information that the mobile wireless access device plans to visit the target intranet in the itinerary corresponding to the planned itinerary information, or the mobile wireless access device plan Itinerary information for visiting the target intranet after reaching the planned itinerary node. The planned travel information includes travel information of at least one planned travel node of the mobile wireless access device, wherein the travel information of the planned travel node includes the planned travel time and the corresponding planned travel location. For example, the itinerary information of the planned itinerary node may be the arrival at Shenzhen Baoan International Airport at 14:00 on March 17, 2019, Beijing time, or the arrival at Shanghai Hongqiao International Airport in 3 hours. The planned itinerary information sent by the mobile wireless access device to the intranet firewall distribution device may be input by the user through the mobile wireless access device, or may be through a user connected to the mobile wireless access device After the terminal is input, it is sent to the mobile wireless access device. It can also be extracted by the user terminal from user information such as emails, short messages, memos, etc. of the user terminal. The mobile wireless access device obtains planned itinerary information. There are no restrictions.

S202: The intranet firewall distribution device determines a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information.

Wherein, the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned trip node.

Specifically, the arrival of the mobile wireless access device at the planned journey node may include at least two situations: the mobile wireless access device arrives at the planned journey location corresponding to the planned journey node and the system time arrives at the planned journey node The corresponding planned travel time.

In view of the first of the above two cases, an optional implementation manner for determining the first intranet firewall is: the intranet firewall distribution device will target multiple intranets deployed on the target intranet Among the firewalls, the intranet firewall closest to the planned travel location is determined to be the first intranet firewall. For example, the deployment locations of the three intranet firewalls deployed for the target intranet are New York, Shanghai, and London respectively, and the planned travel location is Paris, then the intranet firewall deployed in London is determined as the first intranet firewall. Net firewall.

In view of the second situation of the above two cases, an optional implementation manner for determining the first intranet firewall is: the planned itinerary information also includes the planned travel location of the mobile wireless access device During the stay period, the intranet firewall distribution device obtains the low-load period of each intranet firewall deployed for the target intranet, and the intranet firewall distribution will target the multiple intranet firewalls deployed on the target intranet , The intranet firewall with the longest overlap period of the low load period and the stay period is determined as the first intranet firewall. For example, the low-load periods of the three intranet firewalls deployed for the target intranet are 23:00 Beijing time-3 o'clock the next day, 8:00 Beijing time-9 o'clock, Beijing time 19:00-24:00, the plan The stay period included in the itinerary information is 23:00 Beijing time-9:00 the next day, and the intranet firewall distribution device determines the intranet firewall whose low load period is 23:00 Beijing time-3:00 next day as the first intranet Firewall.

Here, when the planned trip node includes multiple nodes, the first intranet firewall corresponding to each planned trip node is determined according to the specific implementation steps described above.

S203: When the intranet firewall distribution device determines, according to the access device status information of the mobile wireless access device, that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information, Sending the first IP address of the first intranet firewall to the mobile wireless access device.

Specifically, the intranet firewall distribution device determines that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information according to the access device status information of the mobile wireless access device may at least Contains the following two implementation methods:

1. The status information of the access device includes the current actual travel location of the mobile wireless access device, and the intranet firewall distribution device determines between the actual travel location and the planned travel location in the planned travel node When the distance of is less than the preset distance threshold, it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information. The current actual travel location of the mobile wireless access device may be sent by the mobile wireless access device to the intranet firewall distribution device in real time, or it may be the intranet firewall distribution device according to the mobile wireless access The real-time positioning information sent by the device is determined by positioning technology.

2. The access device status information includes the current actual travel time of the mobile wireless access device, and the intranet firewall distribution device determines that the actual travel time is consistent with the planned travel time in the planned travel node , Determining that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information. Here, the actual travel time is consistent with the system time of the intranet firewall distribution device.

S204: The mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.

Specifically, the mobile wireless access device sends a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall sends a firewall connection request to the mobile device according to the firewall connection request. After the identity verification of the access device is passed, a connection with the mobile wireless access device is established.

In an implementation manner, the firewall connection request carries the access device identification code of the mobile wireless access device, such as a MAC address, and the first intranet firewall determines that the access device identification code is preset When one of the identification codes of the access device is allowed to be connected, it is determined that the identity authentication of the mobile wireless access device is passed.

In another implementation manner, the firewall connection request carries the user name and password input by the user through the mobile wireless access device, and the first intranet firewall determines that the user name and password are preset users allowed to connect When one of the name and password is set, it is determined that the identity authentication of the mobile wireless access device is passed.

In yet another implementation manner, the firewall connection request carries the digital certificate of the mobile wireless access device, and the first intranet firewall is based on the access device digital certificate carried in the access device digital certificate. The issuer information of the access device determines the certificate issuer of the digital certificate of the access device; after the first intranet firewall obtains the issuer digital certificate of the certificate issuer, it passes the issuer contained in the issuer’s digital certificate The public key is used to decrypt the digital signature in the digital certificate of the access device using the public key of the issuing party to obtain the certificate fingerprint of the digital certificate of the access device. The first intranet firewall will use the specified Kazakhstan The Greek algorithm performs a hash calculation on the digital certificate of the access device to obtain the hash value of the digital certificate; the first intranet firewall determines that the hash value of the digital certificate obtained by the hash calculation of the first intranet firewall is When the fingerprints of the access device certificates are consistent, it is determined that the identity authentication of the mobile wireless access device is passed.

Specifically, the mobile wireless access device initiates a three-way handshake to establish a connection based on the TCP/IP protocol with the first intranet firewall. The specific steps are as follows: the mobile wireless access device sends to the first intranet firewall SYN (Synchronize Sequence Numbers, synchronization sequence number) data packet; after the first intranet firewall receives the SYN data packet, it sends a SYN+ACK (ACKnowledge Character, confirmation character) data packet to the mobile wireless access device After the mobile wireless access device receives the SYN+ACK data packet, it feeds back the ACK data packet to the first intranet firewall; the first intranet firewall receives the feedback from the mobile wireless access device After the ACK packet, the connection between the mobile wireless access device and the first intranet firewall is established.

Optionally, the mobile wireless access device obtains the real-time travel location of the mobile wireless access device; the mobile wireless access device determines that the mobile wireless access device arrives at the plan according to the real-time travel location When the planned travel location corresponding to the travel node, a firewall connection request is sent to the first intranet firewall according to the first IP address. Since the actual itinerary corresponding to the planned itinerary node has certain uncertainty, after the intranet firewall allocation device sends the first IP address to the mobile wireless access device, the mobile wireless access When the device confirms that it has arrived at the planned itinerary location corresponding to the planned itinerary node, it sends a firewall connection request to the first intranet firewall to avoid the inaccuracy of the actual itinerary, which may cause the mobile wireless access device to arrive at the planned itinerary. When the itinerary is delayed, the intranet firewall connected to the mobile wireless access device is switched prematurely, ensuring the accuracy and effectiveness of the intranet firewall switching.

S205: The mobile wireless access device disconnects from the second intranet firewall.

Here, the second intranet firewall means that the intranet firewall allocation device, before acquiring the planned itinerary information of the mobile wireless access device, according to the intranet access to the target intranet sent by the mobile wireless access device Request, determine the intranet firewall matched by the mobile wireless access device from the multiple intranet firewalls deployed for the target intranet.

The mobile wireless access device initiates four waves to disconnect the TCP/IP connection with the second intranet firewall. The specific steps are as follows: the mobile wireless access device sends a FIN (Finish) to the second intranet firewall. Character, the end character) data packet; after receiving the FIN data packet, the second intranet firewall sends an ACK data packet to the mobile wireless access device; the second intranet firewall sends an ACK data packet to the mobile wireless access device The incoming device sends a FIN data packet; after receiving the FIN data packet, the mobile wireless access device sends an ACK data packet to the second intranet firewall; the second intranet firewall distribution device receives the ACK After the data packet, the disconnection of the connection between the mobile wireless access device and the second intranet firewall is completed.

Optionally, the network connection method may further include steps S206 to S211:

S206: The user terminal sends an intranet access request for the target intranet to the mobile wireless access device.

Specifically, before step S206, the user terminal may send a wireless network connection request to the mobile wireless access device, and the mobile wireless access device may directly establish a connection with the user terminal, or through the wireless network After the user terminal identity information carried in the connection request is verified, a connection with the user terminal is established. The user terminal identity information may be the user name and password input by the user inputted by the user terminal to access the wireless network established by the mobile wireless access device, and may also be the biometric input received by the user terminal The information may also be terminal equipment identification information of the user terminal.

Here, step S206 is executed after step S205, that is, the intranet access request of the user terminal in step S206 is that after the mobile wireless access device is disconnected from the second intranet firewall, the user terminal Intranet access request to the target intranet.

S207: The mobile wireless access device sends the intranet access request to the first intranet firewall.

S208: The first intranet firewall routes the intranet access request to the intranet server of the target intranet.

Specifically, the intranet access request is an access request for a server in the target intranet, such as an access request for a Web server in the target intranet, an access request for an FTP server in the target intranet, and an access request for a server in the target intranet. State the access request of the mail server in the target intranet, etc. After the first intranet firewall receives the intranet access request sent by the mobile wireless access device, it sends the intranet access request to the router of the target intranet through the external network. The router routes the intranet access request to the corresponding intranet server in the target intranet through the target intranet.

S209: The intranet server returns an intranet request response message in response to the intranet access request to the first intranet firewall.

Specifically, after the intranet server generates an intranet request response message in response to the intranet access request, it sends the intranet request response message to the router of the target intranet through the target intranet, and the target The router of the internal network sends the internal network request response message to the first internal network firewall through the external network. For example, if the intranet access request is a request to obtain a file in a file server in the target intranet, the intranet request response message may be the file sent by the file server.

S210: The first intranet firewall sends the intranet request response message to the mobile wireless access device.

S211: The mobile wireless access device sends the intranet request response message to the user terminal.

In the embodiment of this application, after receiving the planned itinerary information for access to the target intranet sent by the mobile wireless access device, the intranet firewall distribution device selects from multiple intranet firewalls deployed for the target intranet according to the planned itinerary information , Determine the first intranet firewall assigned to the mobile wireless access device when the mobile wireless access device reaches the planned trip node, and determine the mobile wireless access device's access device status information according to the mobile wireless access device When the access device meets the itinerary node condition corresponding to the planned itinerary node in the planned itinerary information, the first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device is connected to the mobile wireless access device according to the first IP address. The first intranet firewall establishes a connection and disconnects the connection with the second intranet firewall. It realizes the recommendation to the mobile wireless access device to switch the connected intranet firewall according to the planned itinerary information of the mobile wireless access device, ensuring that the user uses the user terminal to access the target intranet through the connection between the mobile wireless access device and the intranet firewall Network quality.

Referring to FIG. 3, FIG. 3 is a schematic diagram of system interaction of another network connection method provided by an embodiment of the application. As shown in the figure, the method may include:

S301: The mobile wireless access device sends the planned itinerary information for accessing the target intranet to the intranet firewall distribution device.

S302. The intranet firewall distribution device determines from the multiple intranet firewalls deployed for the target intranet according to the planned itinerary information that when the mobile wireless access device reaches the planned itinerary node The first intranet firewall allocated by the mobile wireless access device.

For the specific implementation of step S301 and step S302, please refer to the specific implementation of step S201 and step S202 in the embodiment corresponding to FIG. 2, which will not be repeated here.

S303. The mobile wireless access device acquires the real-time travel location of the mobile wireless access device from a preset time before the planned travel time of the planned travel node to the planned travel time of the planned travel node .

For example, the itinerary information of the planned itinerary node is the arrival at Beijing West Railway Station at 15:00 on February 3, 2019 Beijing time, the preset time is 14:30 on February 3, 2019 Beijing time, and the preset location The mobile wireless access device mentioned above will obtain its real-time travel location through positioning technology from 14:30 on February 3, 2019 Beijing time to 15:00 on February 3, 2019 Beijing time.

S304: The mobile wireless access device sends location arrival information to the intranet firewall distribution device when it is determined according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node.

Here, determining that the mobile wireless access device itself arrives at the planned travel location corresponding to the planned travel node includes: an optional method for the mobile wireless access device to determine the actual travel location and the planned travel location Consistent, another optional way is for the mobile wireless access device to determine that the distance between the actual travel location and the planned travel location is less than a preset distance threshold.

S305: The intranet firewall allocation device sends the first IP address of the first intranet firewall to the mobile wireless access device according to the location arrival information.

S306: The mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address.

S307: The mobile wireless access device disconnects from the second intranet firewall.

After step S307, when the mobile wireless access device receives the intranet access request for the target intranet sent by the user terminal connected to the mobile wireless access device, it passes through the connection with the first intranet firewall. The connection provides the user terminal with a service to access the target intranet. For a specific implementation manner, please refer to the implementation manner of step S206 to step S211 in the embodiment corresponding to FIG. 2, which will not be repeated here.

In the embodiment of the present application, after receiving the planned itinerary information for accessing the target intranet sent by the mobile wireless access device, the intranet firewall distribution device uses the planned itinerary information from a plurality of devices deployed for the target intranet. In the internal network firewall, it is determined that the first internal network firewall allocated to the mobile wireless access device when the mobile wireless access device arrives at the planned trip node, and the mobile wireless access device is The itinerary location is monitored, and when it is determined according to its actual itinerary location that it arrives at the planned itinerary location corresponding to the planned itinerary node of the planned itinerary information, the location arrival information is sent to the intranet firewall distribution device to request the intranet After the firewall allocation device sends the first IP address of the first intranet firewall to the mobile wireless access device, the mobile wireless access device switches the connected intranet firewall according to the first IP address. It is ensured that as soon as the mobile wireless access device arrives at the planned itinerary location corresponding to the planned itinerary node of the planned itinerary information, the connected intranet firewall is switched, which ensures the timeliness and effectiveness of the intranet firewall switching.

Referring to Figure 4, Figure 4 is a schematic structural diagram of a mobile wireless access device provided by an embodiment of the application. As shown in the figure, the mobile wireless access device 40 may at least include a itinerary sending unit 401, an address receiving unit 402, and The firewall connection unit 403, where:

The itinerary sending unit 401 is configured to send the planned itinerary information for accessing the target intranet to the intranet firewall distribution device, so that the intranet firewall distribution device selects the planned itinerary for the target intranet according to the planned itinerary information. A first intranet firewall is determined among the three intranet firewalls, and the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned trip node, wherein the planned trip The information includes travel information of at least one planned travel node of the mobile wireless access device, and the travel information of the planned travel node includes the planned travel time and the corresponding planned travel location.

The address receiving unit 402 is configured to receive a first IP address of the first intranet firewall, where the first IP address is that the intranet firewall allocation device is in accordance with the access device status information of the mobile wireless access device When it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information to the mobile wireless access device.

The firewall connection unit 403 is configured to send a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall communicates with the mobile wireless access device according to the firewall connection request establish connection.

The firewall connection unit 403 is further configured to disconnect the connection with a second intranet firewall for the mobile wireless access device when sending the planned itinerary to the intranet firewall distribution device Before the information, the intranet firewall distribution device determines all the intranet firewalls from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request sent by the mobile wireless access device for the target intranet. The firewall matches the mobile wireless access equipment.

Optionally, the firewall connection unit 403 is specifically configured to:

Acquiring the real-time travel location of the mobile wireless access device;

When it is determined according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, sending a firewall connection request to the first intranet firewall according to the first IP address.

Optionally, the firewall connection unit 403 is further configured to:

Acquiring the real-time travel location of the mobile wireless access device from a preset time before the planned travel time of the planned travel node to the planned travel time of the planned travel node;

When it is determined according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, the location arrival information is sent to the intranet firewall distribution device so that the intranet firewall distribution device Sending the first IP address to the mobile wireless access device according to the location arrival information.

Optionally, the itinerary sending unit 401 is further configured to:

Receiving planned itinerary information for accessing the target intranet sent by the user terminal, where the planned itinerary information is extracted by the user terminal from user information stored in the user terminal and sent to the mobile wireless access device.

In specific implementation, the mobile wireless access device can execute various steps performed by the mobile wireless access device in the network connection methods shown in Figures 2 to 3 through its built-in functional modules. For specific implementation details, refer to Figure 2 The implementation details of each step in the embodiment corresponding to FIG. 3 will not be repeated here.

In the embodiment of the application, after receiving the planned itinerary information for access to the target intranet sent by the itinerary sending unit, the intranet firewall distribution device determines from the multiple intranet firewalls deployed for the target intranet according to the planned itinerary information The first intranet firewall allocated to the mobile wireless access device when the mobile wireless access device arrives at the planned trip node, and determines the mobile wireless access based on the access device status information of the mobile wireless access device When the device satisfies the itinerary node condition corresponding to the planned itinerary node in the planned itinerary information, it sends the first IP address of the first intranet firewall to the address receiving unit, so that the firewall connection unit establishes with the first intranet firewall according to the first IP address After connecting and disconnecting from the second intranet firewall, the message transmission unit provides the user terminal connected to the mobile wireless access device with the service of accessing the intranet server in the target intranet. It realizes the recommendation to the mobile wireless access device to switch the connected intranet firewall according to the planned itinerary information of the mobile wireless access device, ensuring that the user uses the user terminal to access the target intranet through the connection between the mobile wireless access device and the intranet firewall Network quality.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of an intranet firewall distribution device provided by an embodiment of the application. As shown in the figure, the firewall distribution device 50 may at least include an itinerary information acquisition unit 501 and a first intranet firewall determination Unit 502 and IP address sending unit 503, where:

The itinerary information acquiring unit 501 is configured to acquire planned itinerary information for a mobile wireless access device to access a target intranet, where the planned itinerary information includes itinerary information of at least one planned itinerary node of the mobile wireless access device, where: The itinerary information of the planned itinerary node includes the planned travel time and the corresponding planned travel location;

The first intranet firewall determining unit 502 is configured to determine a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, wherein the first intranet firewall Is an intranet firewall matched by the mobile wireless access device when it reaches the planned trip node;

The IP address sending unit 503 is configured to: when it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information according to the access device status information of the mobile wireless access device, The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and Disconnect the connection with the second intranet firewall. The second intranet firewall assigns the device to the intranet firewall before acquiring the planned itinerary information of the mobile wireless access device, according to the target information sent by the mobile wireless access device. The intranet access request of the target intranet is an intranet firewall matched by the mobile wireless access device determined from a plurality of intranet firewalls deployed for the target intranet.

Optionally, the first intranet firewall determining unit 502 is specifically configured to: among the multiple intranet firewalls deployed for the target intranet, the distance to the planned travel location in the itinerary information of the planned travel node is the closest The internal firewall of is determined to be the first internal firewall.

Optionally, the planned itinerary information further includes the planned stay period of the mobile wireless access device at the planned itinerary location; the first intranet firewall determining unit 502 is specifically configured to: obtain information specific to the target intranet The low load period of each intranet firewall deployed; among the multiple intranet firewalls deployed for the target intranet, the intranet firewall with the longest overlap period between the low load period and the stay period is determined as the Describe the first intranet firewall.

Optionally, the access device status information includes the current actual travel location of the mobile wireless access device; the IP address sending unit 503 is specifically configured to: determine the actual travel location and the planned travel node When the distance between the planned travel locations in is less than the preset distance threshold, it is determined that the mobile wireless access device meets the travel node condition corresponding to the planned travel node in the planned travel information.

Optionally, the access device status information includes the current actual travel time of the mobile wireless access device; the IP address sending unit 503 is specifically configured to: determine the actual travel time and the planned travel node When the planned travel time in the, it is determined that the mobile wireless access device meets the travel node condition corresponding to the planned travel node in the planned travel information.

In specific implementation, the intranet firewall distribution device can execute the steps performed by the intranet firewall distribution device described in the network connection method shown in Figures 2 to 3 through its built-in functional modules. For specific implementation details, please refer to Figure 2. The implementation details of each step in the embodiment corresponding to FIG. 3 will not be repeated here.

In the embodiment of the present application, after the itinerary information acquiring unit receives the planned itinerary information for access to the target intranet sent by the mobile wireless access device, the first intranet firewall determination unit determines from the planned itinerary information from the target intranet deployed Among the multiple intranet firewalls, it is determined that the first intranet firewall allocated to the mobile wireless access device when the mobile wireless access device reaches the planned itinerary node, and the IP address sending unit is based on the mobile wireless access device When the status information of the access device determines that the mobile wireless access device meets the travel node conditions corresponding to the planned travel node in the planned travel information, the first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device The access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects the connection with the second intranet firewall. It realizes the recommendation to the mobile wireless access device to switch the connected intranet firewall according to the planned itinerary information of the mobile wireless access device, ensuring that the user uses the user terminal to access the target intranet through the connection between the mobile wireless access device and the intranet firewall Network quality.

Referring to FIG. 6, FIG. 6 is a schematic structural diagram of another mobile wireless access device provided by an embodiment of the application. As shown in the figure, the service data transfer apparatus 60 includes a processor 601, a memory 602, and a communication interface 603. The processor 601 is connected to the memory 602 and the communication interface 603. For example, the processor 601 may be connected to the memory 602 and the communication interface 603 through a bus.

The processor 601 is configured to support the mobile wireless access device to perform corresponding functions in the network connection methods described in FIGS. 2 to 3. The processor 601 may be a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), a hardware chip, or any combination thereof. The foregoing hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (Programmable Logic Device, PLD), or a combination thereof. The aforementioned PLD may be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field programmable logic gate array (Field-Programmable Gate Array, FPGA), a general array logic (Generic Array Logic, GAL) or any combination thereof.

The memory 602 is used to store program codes and the like. The memory 602 includes internal memory, which may include at least one of the following: volatile memory (such as dynamic random access memory (DRAM), static RAM (SRAM), synchronous dynamic RAM (SDRAM), etc.) and non-volatile memory (For example, one-time programmable read-only memory (OTPROM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM). The memory 602 may also include external memory, external The memory may include at least one of the following: Hard Disk Drive (HDD) or Solid-State Drive (SSD), flash drive, such as high-density flash (CF), secure digital (SD), micro SD, mini type SD, limit number (xD), memory stick, etc.

The communication interface 603 is used to receive or send data.

The processor 601 may call the program code to perform the following operations:

The intranet firewall distribution device obtains the planned itinerary information for the mobile wireless access device to access the target intranet, where the planned itinerary information includes the itinerary information of at least one planned itinerary node of the mobile wireless access device, wherein the plan The itinerary information of the itinerary node includes the planned travel time and the corresponding planned travel location;

The intranet firewall distribution device determines a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, where the first intranet firewall is the mobile An intranet firewall matched by the wireless access device when it reaches the planned trip node;

When the intranet firewall distribution device determines that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information according to the access device status information of the mobile wireless access device, The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects Open the connection with the second intranet firewall, which is the distribution device for the intranet firewall before obtaining the planned itinerary information of the mobile wireless access device according to the information sent by the mobile wireless access device. For the intranet access request of the target intranet, the intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.

It should be noted that the implementation of each operation may also correspond to the corresponding description of the method embodiment shown in FIG. 2 to FIG. 3; the processor 601 may also be used to perform other operations in the above method embodiment.

The embodiments of the present application also provide a computer non-volatile readable storage medium, the computer non-volatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions are executed by a computer. When the computer is caused to execute the method described in the foregoing embodiment, the computer may be a part of the aforementioned intranet firewall distribution device or mobile wireless access device.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The program can be stored in a computer readable storage medium. During execution, it may include the procedures of the above-mentioned method embodiments. Wherein, the storage medium may be a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM), etc.

The above-disclosed are only preferred embodiments of this application, and of course the scope of rights of this application cannot be limited by this. Therefore, equivalent changes made according to the claims of this application still fall within the scope of this application.

Claims (20)

1. A network connection method, characterized by comprising:

   The intranet firewall distribution device obtains the planned itinerary information for the mobile wireless access device to access the target intranet, where the planned itinerary information includes the itinerary information of at least one planned itinerary node of the mobile wireless access device, wherein the plan The itinerary information of the itinerary node includes the planned travel time and the corresponding planned travel location;

   The intranet firewall distribution device determines a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, where the first intranet firewall is the mobile An intranet firewall matched by the wireless access device when it reaches the planned trip node;

   When the intranet firewall distribution device determines that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information according to the access device status information of the mobile wireless access device, The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects Open the connection with the second intranet firewall, which is for the intranet firewall distribution device to obtain the planned itinerary information of the mobile wireless access device according to the information sent by the mobile wireless access device. For the intranet access request of the target intranet, the intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.
2. The method according to claim 1, wherein the intranet firewall distribution device determines that the first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information includes :

   The intranet firewall distribution device determines the intranet firewall that is closest to the planned trip location in the itinerary information of the planned trip node among the multiple intranet firewalls deployed for the target intranet as the first intranet Net firewall.
3. The method according to claim 1, wherein the planned itinerary information further comprises the planned stay period of the mobile wireless access device at the planned itinerary location;

   According to the planned itinerary information, the intranet firewall distribution device determines that the first intranet firewall includes:

   Acquiring, by the intranet firewall distribution device, the low load period of each intranet firewall deployed for the target intranet;

   The intranet firewall distribution device determines, among the multiple intranet firewalls deployed for the target intranet, the intranet firewall with the longest overlap period of the low load period and the stay period as the first intranet Net firewall.
4. The method according to any one of claims 1 to 3, wherein the access device status information includes the current actual travel location of the mobile wireless access device;

   According to the access device status information of the mobile wireless access device, the intranet firewall distribution device determining that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information includes:

   When determining that the distance between the actual travel location and the planned travel location in the planned travel node is less than a preset distance threshold, the intranet firewall distribution device determines that the mobile wireless access device satisfies the planned travel information Itinerary node conditions corresponding to the planned itinerary node.
5. The method according to any one of claims 1 to 3, wherein the access device status information includes the current actual travel time of the mobile wireless access device;

   According to the access device status information of the mobile wireless access device, the intranet firewall distribution device determining that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information includes:

   When determining that the actual travel time is consistent with the planned travel time in the planned travel node, the intranet firewall distribution device determines that the mobile wireless access device satisfies the travel node corresponding to the planned travel node in the planned travel information condition.
6. A network connection method, characterized by comprising:

   The mobile wireless access device sends the planned itinerary information for accessing the target intranet to the intranet firewall distribution device, so that the intranet firewall distribution device selects from multiple intranets deployed for the target intranet according to the planned itinerary information. A first intranet firewall is determined in the network firewall, and the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned itinerary node, wherein the planned itinerary information includes Travel information of at least one planned travel node of the mobile wireless access device, where the travel information of the planned travel node includes the planned travel time and the corresponding planned travel location;

   The mobile wireless access device receives the first IP address of the first intranet firewall, where the first IP address is that the intranet firewall assigns the device according to the access device status information of the mobile wireless access device , Sending it to the mobile wireless access device when it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information;

   The mobile wireless access device sends a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall communicates with the mobile wireless access device according to the firewall connection request. establish connection;

   The mobile wireless access device disconnects from a second intranet firewall, and the second intranet firewall means that before the mobile wireless access device sends the planned itinerary information to the intranet firewall distribution device, According to the intranet connection request for the target intranet sent by the mobile wireless access device, the intranet firewall distribution device determines the mobile from among the multiple intranet firewalls deployed for the target intranet. A firewall that matches the wireless access device.
7. The method according to claim 6, wherein the mobile wireless access device sending a firewall connection request to the first intranet firewall according to the first IP address comprises:

   Acquiring, by the mobile wireless access device, the real-time travel location of the mobile wireless access device;

   When the mobile wireless access device determines according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, the mobile wireless access device reports to the first intranet firewall according to the first IP address Send a firewall connection request.
8. The method of claim 6, wherein the method further comprises:

   The mobile wireless access device acquires the real-time travel location of the mobile wireless access device from a preset time before the planned travel time of the planned travel node to the planned travel time of the planned travel node;

   When the mobile wireless access device determines according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, it sends location arrival information to the intranet firewall distribution device so that The intranet firewall allocation device sends the first IP address to the mobile wireless access device according to the location arrival information.
9. 8. The method according to any one of claims 6 to 8, wherein the method further comprises:

   The mobile wireless access device receives the planned itinerary information for accessing the target intranet sent by the user terminal, where the planned itinerary information is extracted by the user terminal from the user information stored in the user terminal and sent to the Mobile wireless access equipment.
10. An intranet firewall distribution device is characterized in that it includes:

    The itinerary information acquiring unit is configured to acquire planned itinerary information for the mobile wireless access device to access the target intranet, where the planned itinerary information includes the itinerary information of at least one planned itinerary node of the mobile wireless access device, where all The itinerary information of the planned itinerary node includes the planned travel time and the corresponding planned travel location;

    The first intranet firewall determining unit is configured to determine a first intranet firewall from a plurality of intranet firewalls deployed for the target intranet according to the planned itinerary information, where the first intranet firewall is An intranet firewall that matches when the mobile wireless access device reaches the planned trip node;

    The IP address sending unit is configured to, according to the access device status information of the mobile wireless access device, determine that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information, and set all The first IP address of the first intranet firewall is sent to the mobile wireless access device, so that the mobile wireless access device establishes a connection with the first intranet firewall according to the first IP address, and disconnects Open the connection with the second intranet firewall, which is for the intranet firewall distribution device to obtain the planned itinerary information of the mobile wireless access device according to the information sent by the mobile wireless access device. For the intranet access request of the target intranet, the intranet firewall matched by the mobile wireless access device is determined from a plurality of intranet firewalls deployed for the target intranet.
11. The device according to claim 10, wherein the first intranet firewall determining unit is specifically configured to:

    Among the multiple intranet firewalls deployed for the target intranet, the intranet firewall closest to the planned trip location in the trip information of the planned trip node is determined as the first intranet firewall.
12. The device according to claim 10, wherein the planned itinerary information further comprises the planned stay period of the mobile wireless access device at the planned itinerary location;

    The first intranet firewall determining unit is specifically configured to:

    Acquiring the low load period of each intranet firewall deployed for the target intranet;

    Among the multiple intranet firewalls deployed for the target intranet, the intranet firewall having the longest overlap period of the low load period and the stay period is determined as the first intranet firewall.
13. The device according to any one of claims 10-12, wherein the access device status information includes the current actual travel location of the mobile wireless access device;

    The IP address sending unit is specifically used for:

    When it is determined that the distance between the actual travel location and the planned travel location in the planned travel node is less than a preset distance threshold, it is determined that the mobile wireless access device satisfies the travel corresponding to the planned travel node in the planned travel information Node conditions.
14. The device according to any one of claims 10-12, wherein the access device status information includes the current actual travel time of the mobile wireless access device;

    The IP address sending unit is specifically used for:

    When it is determined that the actual travel time is consistent with the planned travel time in the planned travel node, it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information.
15. A mobile wireless access device, characterized in that it comprises:

    The itinerary sending unit is configured to send the planned itinerary information for accessing the target intranet to the intranet firewall distribution device, so that the intranet firewall distribution device selects the information about the planned itinerary from a plurality of A first intranet firewall is determined in the intranet firewall, and the first intranet firewall is an intranet firewall that matches when the mobile wireless access device reaches the planned itinerary node, wherein the planned itinerary information Including itinerary information of at least one planned itinerary node of the mobile wireless access device, where the itinerary information of the planned itinerary node includes the planned travel time and the corresponding planned travel location;

    The address receiving unit is configured to receive a first IP address of the first intranet firewall, where the first IP address is that the intranet firewall allocation device is based on the access device status information of the mobile wireless access device, Sent to the mobile wireless access device when it is determined that the mobile wireless access device satisfies the travel node condition corresponding to the planned travel node in the planned travel information;

    The firewall connection unit is configured to send a firewall connection request to the first intranet firewall according to the first IP address, so that the first intranet firewall establishes with the mobile wireless access device according to the firewall connection request connection;

    The firewall connection unit is further configured to disconnect the connection with a second intranet firewall for the mobile wireless access device sending the planned itinerary information to the intranet firewall distribution device Previously, the intranet firewall allocation device determined the intranet firewall from the multiple intranet firewalls deployed for the target intranet according to the intranet connection request sent by the mobile wireless access device for the target intranet. Mobile wireless access device matching firewall.
16. The device according to claim 15, wherein the firewall connection unit is specifically configured to:

    Acquiring the real-time travel location of the mobile wireless access device;

    When it is determined according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, sending a firewall connection request to the first intranet firewall according to the first IP address.
17. The device according to claim 15, wherein the firewall connection unit is further configured to:

    Acquiring the real-time travel location of the mobile wireless access device from a preset time before the planned travel time of the planned travel node to the planned travel time of the planned travel node;

    When it is determined according to the real-time travel location that the mobile wireless access device arrives at the planned travel location corresponding to the planned travel node, the location arrival information is sent to the intranet firewall distribution device so that the intranet firewall distribution device Sending the first IP address to the mobile wireless access device according to the location arrival information.
18. The device according to any one of claims 15 to 17, wherein the itinerary sending unit is further configured to:

    Receiving planned itinerary information for accessing the target intranet sent by the user terminal, where the planned itinerary information is extracted by the user terminal from user information stored in the user terminal and sent to the mobile wireless access device.
19. A mobile wireless access device, which is characterized by comprising a processor, a memory, and a communication interface, the processor, the memory and the communication interface are connected to each other, wherein the communication interface is used for receiving and sending data, and the memory is used for In storing program code, the processor is used to call the program code to execute the method according to any one of claims 6-9.
20. A computer nonvolatile readable storage medium, wherein the computer nonvolatile readable storage medium stores a computer program, the computer program includes program instructions, and the program instructions when executed by a processor The processor is caused to execute the method according to any one of claims 1-9.

Images