WO2021068685A1 - 一种通讯电路管理方法、网络设备及存储介质 - Google Patents

一种通讯电路管理方法、网络设备及存储介质 Download PDF

Info

Publication number
WO2021068685A1
WO2021068685A1 PCT/CN2020/112621 CN2020112621W WO2021068685A1 WO 2021068685 A1 WO2021068685 A1 WO 2021068685A1 CN 2020112621 W CN2020112621 W CN 2020112621W WO 2021068685 A1 WO2021068685 A1 WO 2021068685A1
Authority
WO
WIPO (PCT)
Prior art keywords
group
access point
communication circuit
users
information
Prior art date
Application number
PCT/CN2020/112621
Other languages
English (en)
French (fr)
Inventor
施玮
陈华南
龚霞
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2021068685A1 publication Critical patent/WO2021068685A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2425—Traffic characterised by specific attributes, e.g. priority or QoS for supporting services specification, e.g. SLA

Definitions

  • This application relates to the field of communications, and in particular to a communication circuit management method, network equipment and storage medium.
  • the dedicated line access service refers to a service that leases a certain Ethernet interface or certain VLANs (Virtual Local Area Network, virtual local area network) under the interface to a group of users as a whole. Multiple devices can be accessed under a dedicated line, but only one user appears on the broadband access router. In fact, the operator controls the dedicated line for unified authentication and billing, enterprise bandwidth, and access rights.
  • VLANs Virtual Local Area Network, virtual local area network
  • enterprises have evolved from using only one Ethernet interface or certain VLAN access under the interface. Use multiple different Ethernet interfaces or VLAN access under different Ethernet interfaces; the enterprise has evolved from a single address outlet to a single outlet with multiple dual-stack addresses or multiple outlets with multiple dual-stack addresses.
  • the network side such as AAA (Authentication, Authorization, Accounting, authentication and authorization accounting) server
  • AAA Authentication, Authorization, Accounting, authentication and authorization accounting
  • the network side will also use multiple management accounts for management, which not only leads to the network
  • the side needs to maintain and manage a large number of management accounts, which is a big management burden, and it will also cause a lot of inconvenience to enterprises in the process of using private line access or paying for private lines.
  • the communication circuit management method, network equipment, and storage medium provided by the embodiments of the present application.
  • the embodiment of the application provides a communication circuit management method, which includes: after receiving an online request initiated by an access point, sending an authentication request message to an authentication authorization accounting AAA server according to the online request; receiving a characterization authentication sent by the AAA server Passed authentication response message; if it is determined that the access point belongs to a certain group of users and is the first online access point of the group user, the group session information of the group user is created, and the communication circuit corresponding to the group user is turned on; the group user is in A collection of access points sharing group identification information on the AAA server side.
  • the first access point to go online is the first access point that requests to go online; the communication circuits of the group users are managed based on the group session information.
  • An embodiment of the present application also provides a network device, which includes a processor, a memory, and a communication bus; the communication bus is used to realize the connection and communication between the processor and the memory; the processor is used to execute one or more of the storage in the memory Program to implement the steps of the above-mentioned communication circuit management method.
  • An embodiment of the present application further provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the communication circuit management method described above.
  • FIG. 1 is a flowchart of a communication circuit management method provided in Embodiment 1 of this application;
  • 2a is a flow chart of the offline management of group users by the network device provided in the first embodiment of this application;
  • 2b is another flow chart of the offline management of group users by the network device provided in the first embodiment of this application.
  • FIG. 3 is a flow chart of the network device provided in the first embodiment of the application for speed limit management of group users
  • Fig. 4 is a schematic diagram of the private line access service of enterprise A provided in the second embodiment of the application;
  • FIG. 5 is an interaction flow chart of an access point in a group of users going online provided in the second embodiment of the application
  • FIG. 6 is a flow chart of an interaction in which an access point in a group of users goes offline provided in the second embodiment of this application;
  • FIG. 7 is a flow chart of the access point going online in the communication circuit management solution provided in the second embodiment of the application.
  • FIG. 8 is a flowchart of an access point offline in the communication circuit management solution provided in the second embodiment of the application.
  • FIG. 9 is a schematic structural diagram of a communication circuit management device provided in Embodiment 3 of this application.
  • FIG. 10 is a schematic diagram of a hardware structure of a network device provided in Embodiment 4 of this application.
  • the communication circuit management method, network equipment, and storage medium provided in the embodiments of the application mainly solve the technical problem that the broadband access router in the related technology uses multiple different Ethernet interfaces or VLAN access under different Ethernet interfaces.
  • the management of private lines of the same enterprise is complicated, which causes a large management burden on enterprises and operators.
  • Dedicated lines can be divided into two-tier dedicated lines and three-tier dedicated lines according to different access methods.
  • the second-layer dedicated line is connected to a certain interface of the broadband access router or the VLAN of the interface through the data communication-type second-tier equipment, and the address allocation is performed by the broadband access router, and the services of the users under the dedicated line are in accordance with the business control strategy of the dedicated line. For control, all the traffic is collected on the dedicated line, and the bandwidth of the dedicated line is uniformly restricted.
  • the three-layer dedicated line is connected to a certain interface of the broadband access router or under the VLAN of the interface through the three-layer equipment of data communication, such as an enterprise-level router.
  • the address assignment is completed by the enterprise-level router, and the broadband access device serves as the forwarding function.
  • the business of each terminal user under the dedicated line is controlled according to the dedicated line's business control strategy, all traffic is collected on the dedicated line, and the dedicated line is uniformly restricted in bandwidth.
  • the network device After receiving an online request initiated by an access point, the network device sends an authentication request message to the AAA server according to the online request.
  • the network device may be a broadband access router or the like, which is connected to the AAA server in communication and at the same time can also be connected to the access point through a communication circuit. It is understandable that in an actual network, the network device and the access point may also pass through a series of convergent and fixed network physical devices, which are not necessarily directly physically connected.
  • the so-called access point can be a NAT (Network Address Translation) device such as an enterprise-level router.
  • the access point is connected to a broadband access router and other network equipment through a communication circuit (such as an enterprise dedicated line), on the other hand,
  • a local area network can be provided for terminal devices within the range of the local area network, such as mobile phones, tablets, etc., to access through wireless means, or desktop computers, etc. through wired means, so as to realize the interconnection of terminal equipment and the Internet.
  • dedicated line users include but are not limited to enterprises, and can also include organizations or other organizations that need to use dedicated lines to access services.
  • a dedicated line user may have one or more access points.
  • the access point When there is a user on an access point, the access point will initiate an online request to the network device. Therefore, for the network device, the online request it receives can come from having only one access point
  • the dedicated line users can also be dedicated line users who have at least two access points. After receiving an online request from an access point, the network device can assemble an authentication request message according to the online request, and send the authentication request message to the AAA server, and the AAA server will identify the access point Certification.
  • S104 The network device receives an authentication response message sent by the AAA server, which indicates that the authentication has passed.
  • the AAA server After the AAA server receives the authentication request message, it performs a database query to determine whether the user information in the authentication request message is legal. If it is determined that the user information in the authentication request is legal, it will feed back to the network device an authentication response message indicating that the authentication has passed. Text. In some examples of this embodiment, if the AAA server determines through a query that the user information carried in the authentication request message is illegal, it may send a message to the network device indicating that the authentication has failed. Of course, in some other examples, if the AAA server fails to authenticate after receiving the authentication request message, it does not need to feed back any information to the network device. In this way, the network device does not receive the authentication response message indicating that the authentication is passed, so it also The communication circuit corresponding to the access point will not be opened.
  • the characteristics of the group user can be issued by the AAA server to the broadband access server during the authentication process, or configured locally by the broadband access server.
  • S106 If it is determined that the access point belongs to a certain group of users and is the first online access point of the group user, create the group session information of the group user, and turn on the communication circuit corresponding to the group user.
  • the network device After confirming that the authentication of the AAA server is passed, if the network device determines that the access point belongs to a certain group of users, and determines that the access point is the first access point in the group of users to request to go online, that is, it is the first to go online. In point, the network device can create group session information for the group of users and turn on the communication circuit corresponding to the group of users.
  • the so-called “group user” refers to a collection of access points that share the same group of identification information on the AAA server side.
  • the so-called group identification information refers to information that can uniquely distinguish a group of users on the AAA server side and the network device side, such as group user name, group ID number, etc. It should be noted that although a group user is a set of access points that share the same set of identification information, it does not mean that the group user must include two or more access points at the same time. Of course, the group user can include at least two access points at the same time, but in other examples, the group user can also include only one access point. Therefore, the number of access points is not a condition for determining whether a group of users can be formed.
  • the access point in the group user is an access point using dual protocol stack technology, referred to as a dual stack access point, so the group user may also be referred to as a dual stack group user.
  • each access point in a group of users can have different network management accounts on the AAA server side.
  • the individual mobile phone numbers are independent, but they are charged uniformly and share the package.
  • a group user can be understood as a dedicated line user, that is, the dedicated line owner.
  • company A has sub-companies in place x and y, namely sub-enterprise A1 and sub-enterprise A2.
  • enterprise A has opened dedicated lines for both the sub-enterprise A1 and the sub-enterprise A2, respectively. a1 and dedicated line a2.
  • the AAA server will manage the dedicated line a1 according to the network management account corresponding to the sub-enterprise A1, and manage the dedicated line a2 according to the network management account corresponding to the sub-enterprise A2.
  • the traffic bandwidth allocation and billing of leased line a1 and leased line a2 are independent of each other.
  • enterprise A it has two completely independent leased lines. When paying for the two leased lines, enterprise A needs to pay separately. Pay the fee.
  • the access points of the sub-enterprise A1 and the sub-enterprise A2 belong to the same group of users, and the AAA server associates the sub-enterprise A1 with the sub-enterprise A2, which is two Users configure the same group identification information, and the AAA server and broadband access server can perform unified traffic bandwidth classification and accounting for the two dedicated lines based on the group identification information of the group of users.
  • the network device needs to determine whether the access point belongs to a group user based on the authentication response message fed back by the AAA server.
  • the AAA server stores the mapping relationship between each communication circuit and the group of users. It should be understood that there is a unique correspondence between the communication circuit and the access point. Therefore, it can be considered that the AAA server stores the access The mapping relationship between points and group users. In this way, after the AAA server receives an authentication request message for the access point from the network device, it can determine that the access point belongs to the group user by querying the mapping relationship. After the AAA server has passed the authentication of the access point, it can carry the group information of the group user to which the access point belongs in the authentication response message. After receiving the authentication response message, the network device can use the group information in the authentication response message. The information determines that the access point currently requesting to go online belongs to a group of users.
  • the network device does not need to rely on the authentication response message fed back by the AAA server when determining whether the access point currently requested to go online belongs to the group user, because in these examples, the network device itself
  • the mapping relationship between each communication circuit and group users can be maintained. In this way, after receiving an online request initiated by an access point, the network device can query its locally stored mapping relationship to determine whether the access point is Is a member of the group users.
  • the network device determines that the access point currently requesting to go online belongs to a certain group of users, and determines that the access point is the "first online access point" of the group of users, the network device can be the group of users.
  • the user creates group session information, which is mainly used for unified authorization and traffic statistics for the group of users.
  • first online access point refers to the first access point in a group of users that requests to go online. There is no doubt that in a group of users, there will only be one first online access point, except for the first online access point. Except for the access point, the rest of the access points in the group users are all "non-first online access points", that is, they are not the first access points to request to go online. It should be understood that under normal circumstances, the first online access point of a group of users is not fixed.
  • A1 may It is the first access point to request to go online, and in other cases, A2 may be the first access point to request to go online, but in other cases, A3 is the first to go online.
  • the network device can create sub-user session information for the communication circuit corresponding to the group user, and turn on the corresponding communication circuit. It is understandable that the opened communication circuit should include the communication circuit corresponding to the first online access point, and the created sub-user session information should naturally also include the circuit session information of the communication circuit corresponding to the first online access point.
  • the so-called sub-user session information can be used for traffic forwarding and detailed management of user data.
  • the sub-user session information is mainly the circuit information of the communication circuit corresponding to the access point, and network equipment, such as a broadband access router, performs router forwarding work through the telephone session information table.
  • the sub-user session information created by the network device can be in the form of a sub-user session information table.
  • the sub-user session information table includes, but is not limited to, circuit session group identification information, circuit authorized bandwidth (Speed_cir), and circuit charging information (Account) , Circuit MAC information, circuit information (Cir), circuit session identifier (UserID), maximum bearable bandwidth (Speed_Cir).
  • the network device manages the communication circuit of the group user based on the group session information.
  • the network device creates the group session information of the group user and opens the communication circuit corresponding to the group user. After that, it can manage the communication circuit of the group user based on the group session information, for example, other access points in the group user (that is, Non-first online access points) online management, offline management of access points in group users, statistical management of group user traffic, and speed limit management of access points in group users, etc.
  • group session information for example, other access points in the group user (that is, Non-first online access points) online management, offline management of access points in group users, statistical management of group user traffic, and speed limit management of access points in group users, etc.
  • the network device of this embodiment opens the communication circuit corresponding to the group user according to the authentication response message of the AAA server to the first online access point, it can only open the communication circuit corresponding to the first online access point. Therefore, when creating a child In the case of user session information, only the sub-user session information of the communication circuit corresponding to the first-on-line access point is created first. In the subsequent process, if the online request sent by the non-first online access point is received, the sub-user session information is created for the communication circuit corresponding to the non-first online access point, and the communication corresponding to the non-first online access point is opened. Circuit. Undoubtedly, because the group session information is created in the unit of group users, a group user has only one group session information.
  • the network device does not need to be nonsense.
  • the group session corresponding to the first online access point creates group session information, but the non-first online access point inherits the group session information created when the first online access point goes online.
  • the network device when the network device opens the communication circuit corresponding to the group user according to the authentication response message of the AAA server to the first online access point, it can open all the communication circuits corresponding to the group user. In this case, the network device needs to create corresponding sub-user session information for all communication circuits of the group of users. However, it is understandable that although all communication circuits are turned on, only the first online access point is currently online. Therefore, only the first online access point has traffic transmission. For non-first-online access points, if there are users accessing, they can directly start using the network, and non-first-online access points do not need to initiate an online request.
  • the network device when a certain access point is online, can determine that the access point belongs to a group of users according to the group session information, and determine that the access point is not the first user of the group to which it belongs.
  • the access point is online. Therefore, the AAA server has previously authenticated the first online access point in the group to which the access point belongs. Therefore, the AAA server does not need to authenticate the access point currently requesting to go online.
  • the network device receives the online request sent by the access point, it does not need to send an authentication request message to the AAA server according to the online request, it can directly create the sub-user session information corresponding to the access point, and open the corresponding Communication circuit.
  • the network device after receiving the online request, does not determine whether the access point currently requesting to go online is a member of the group user. In this case, the network device does not determine whether the access point currently requested to go online is a member of the group user. For each online request, a corresponding authentication request message will be generated and sent to the AAA server, which will be authenticated by the AAA server. The network device will only determine whether the access point currently requesting to go online belongs to a group user according to the content of the authentication response message fed back by the AAA server, which indicates that the authentication has passed. If it is a group user, it will determine whether it has been There is corresponding group session information.
  • the network device If there is no corresponding group session information, it means that the access point is the first online access point of its group user. Therefore, the network device generates the corresponding group session information and generates the corresponding sub-user Session information, open the corresponding communication circuit; if it exists, it means that the access point is not the first on-line access point of the user in the group to which it belongs. Therefore, it is not necessary to generate group session information, but directly generate the sub-users of the corresponding communication circuit. Session information, open the corresponding communication circuit.
  • the offline time of the group user should be the time when the last access point in the group user goes offline, so as to ensure that the users under the group user can use normally The internet.
  • the last offline access point in the group of users is referred to as the "last offline access point”. Therefore, when there is an access point in the group user requesting to go offline, based on whether the access point is the last offline access point, the network equipment can refer to the following management schemes for management, please refer to the flowchart shown in Figure 2a:
  • S200 Receive a logout request initiated by any access point in the group of users.
  • the offline order of each access point has nothing to do with the online order. Therefore, when the network device receives the offline request of the access point, it cannot Ensure the order in which offline requests are received. Therefore, the offline request can be initiated by any access point in the group user.
  • S202 Determine whether the access point that currently initiates the offline request is the last offline access point of the group user.
  • S204 Close the communication circuit of the access point, and accumulate the billing information of all offline access points in the group of users.
  • the network equipment is only Close the communication circuit of the access point, accumulate the billing information of all offline access points in the group user, and delete the sub-user session information of the current offline access point.
  • S206 Close the communication circuit of the access point, accumulate the charging information of all offline access points in the group user, and delete the group session information.
  • the network device determines that the access point currently requesting to go offline is the last offline access point of the user in the group to which it belongs, it means that all access points of the group of users have gone offline, so the entire group of users can be All offline, so the network device will not only close the access point’s communication circuit, accumulate the billing information of all offline access points in the group users, and delete the sub-user session information of the current offline access point’s communication circuit, The group session information will also be deleted.
  • S208 The accumulated accounting information of the group users is carried in an accounting stop message and sent to the AAA server.
  • the network device can send the accumulated accounting information corresponding to the group of users to the AAA server.
  • the network device can send the accounting stop message to the AAA server.
  • the server sends its accumulated billing information.
  • the AAA server receives the accounting stop message, it can determine the overall traffic usage of the corresponding group of users based on the accounting information in it. In this way, AAA can manage an owner with multiple communication circuits based on a group of users, for example Corporate network payment is more convenient for both the network side and the owner of the communication circuit.
  • the network device After an access point in the group of users initiates a logout request, the network device first determines whether the access point is the last offline access point, and then according to the requested access point Type to perform subsequent operations. However, it is understandable that regardless of whether the access point requesting to go offline is the last offline access point of the group user, the network device will close the communication circuit corresponding to the access point, and accumulate the counts of the currently offline access points. Charge information, and then delete the sub-user session information corresponding to the access point. The difference is that if it is the last offline access point, the network device will process the group session information and also send a charging stop message. If the access point is not the last offline access point, the network device will not The following two actions will be performed. Therefore, this embodiment also provides a solution for offline management and traffic statistics management, see Figure 2b:
  • S212 Close the communication circuit of the access point, and accumulate the billing information of all offline access points in the group of users;
  • S214 Determine whether the access point is the last offline access point of the group user.
  • S216 Delete the group session information, carry the accumulated accounting information of the group users in the accounting stop message and send it to the AAA server.
  • S302 Determine the group authorized bandwidth uniformly authorized by the AAA server for the group user according to the group session information, and determine the maximum bearable bandwidth of each communication circuit corresponding to the group user.
  • the group session information defines the group authorized bandwidth of the group user, and the group authorized bandwidth is authorized by the AAA server for a group session at the same time, indicating the maximum traffic bandwidth of the group of users at the same time. Therefore, the network device can determine the group authorized bandwidth uniformly authorized by the AAA server for the group user according to the group session information.
  • Each communication circuit has its maximum bearable bandwidth.
  • the value of the maximum bearable bandwidth of each communication circuit can be preset at the network device. Therefore, the sub-user session information generated by the network device for each communication circuit can include it. The corresponding maximum bearable bandwidth, therefore, the network device can also determine the maximum bearable bandwidth of each communication circuit corresponding to the group of users.
  • S304 Determine the circuit authorized bandwidth corresponding to each communication circuit according to the group authorized bandwidth and the maximum bearable bandwidth of each communication circuit.
  • the network device may divide the group speed limit value according to the ratio between the maximum bearable bandwidth of each communication circuit to obtain the circuit authorized bandwidth corresponding to each communication circuit. For example, assume that the authorized bandwidth of a group of users is Speed, and the group includes two access points A1 and A2. The corresponding communication circuits of the two access points are a1 and a2 respectively, and the maximum bearable bandwidth of a1 Is 200M, the maximum bearable bandwidth of a2 is 400M, then the ratio between the maximum bearable bandwidth of these two communication circuits is 1:2, therefore, divide the Speed according to the ratio of 1:2, and the communication circuit a1 can get The authorized circuit bandwidth is Speed/3, and the authorized circuit bandwidth available for the communication circuit a2 is 2*Speed/3.
  • the manner in which the network device determines the circuit authorized bandwidth corresponding to each communication circuit according to the group authorized bandwidth and the maximum bearable bandwidth of each communication circuit is not limited to the above example.
  • S306 Control the data flow of each communication circuit according to the circuit authorized bandwidth of each communication circuit.
  • the network device After determining the circuit authorized bandwidth of each communication circuit, the network device can control the data flow of each communication circuit according to the circuit authorized bandwidth of each communication circuit.
  • the communication circuit management method provided by the embodiments of the present application performs unified online, offline, speed limit, and traffic statistics management on one or at least two communication circuits of the same owner based on the concept of group users, so that the AAA server does not need to perform any
  • the communication circuits corresponding to different access points perform non-independent billing, speed limit, etc., which is beneficial to reduce the management burden on the AAA server side, and also helps to improve the owner's experience of using private line access services.
  • enterprise A has the characteristics of multi-regional business.
  • the enterprise has successively opened the first communication circuit a1, the second communication circuit a2, and the third communication circuit a3, which are three different single stacks or
  • the dual-stack business dedicated line serves as the data communication channel for the daily work of the enterprise.
  • Enterprise A handles the total 1G rate broadband, which is represented as an enterprise account in the broadband service contractor’s operating system and the AAA accounting system on the AAA server side. Therefore, the rate under the same account is used for authorization, and the rate under the same account is used for authorization. Information is booked. Therefore, there are requirements for different physical link access, unified accounting and policy management.
  • the first communication circuit a1 and the second communication circuit a2 opened by enterprise A are all connected from the same physical port Port1, but different Svlan (Service VLAN, service VLAN) and Cvlan (Customer VLAN) are used. VLAN) circuit for business differentiation; the second communication circuit a2 and the third communication circuit a3 opened by enterprise A are connected from different physical ports, the second communication circuit a2 uses physical ports Port1+Svlan2+Cvlan2, and the third communication circuit a3 Use physical ports Port3+Svlan3+Cvlan3. Therefore, cross-physical ports, cross-circuits, and even cross-physical single-board access scenarios appear.
  • Svlan Service VLAN, service VLAN
  • Cvlan Customer VLAN
  • access point 1 and access point 2 use MAC1 as the second layer communication address of the physical link layer, and access point 3 uses MAC3 as the second layer of the physical link layer. Layer communication address. Therefore, different access points in the enterprise may have the same access MAC or different access conditions.
  • the access point 1 is preset with a circuit bandwidth of 200M; the access point 2 is preset with a circuit bandwidth of 500M; and the access point 3 is preset with a circuit bandwidth of 800M. Therefore, there is a requirement for enterprises to reasonably allocate dual-stack speeds on different circuits with 1G bandwidth.
  • This embodiment provides a group access solution for broadband access routers, which effectively solves the problem of unified policy management on different ports, including but not limited to access strategies for different physical circuits, bandwidth allocation strategies for different circuits, and unified charging strategies. , Different or the same MAC access problem.
  • Broadband access routers can also be called MSE (MSE, multi-service edge) equipment.
  • MSE multi-service edge
  • the broadband access router After receiving the online request, the broadband access router assembles and fills an authentication request message, and sends the authentication online request message to the AAA server.
  • S503 The AAA server performs database query.
  • S504 The AAA server sends an authentication response message to the broadband access router.
  • the AAA server After querying, the AAA server finds that the user information in the authentication request message is legal, and then sends an authentication response message indicating that the authentication has passed to the broadband access router.
  • the broadband access router generates group session information, and at the same time generates sub-user session information for the first communication circuit a1.
  • the broadband access router processes the authentication response message, determines that the user type on the first communication circuit a1 is a dual-stack group user type, access point 1 belongs to group user A, and determines that access point 1 is the first user of group user A.
  • the online access point therefore, the broadband access router generates group session information for group user A, and at the same time generates sub-user session information for the first communication circuit a1.
  • Group sessions are used for unified user authorization and traffic statistics; sub-user session information is used for traffic forwarding and detailed management of user data.
  • the broadband access router sends the online response to the access point 1 through the first communication circuit a1.
  • the user is authenticated and the first communication circuit a1 is opened to allow traffic forwarding.
  • the broadband access router After receiving the online request, the broadband access router generates sub-user session information for the second communication circuit a2.
  • the broadband access router After confirming that access point 2 receives the online request sent by access point 2, according to the online request and the group session information, it is determined that access point 2 belongs to group user A, and the group session information of this group already exists, so the broadband access router will Without sending an authentication request message for the access point 2 to the AAA server, the broadband access router generates the sub-user session information of the second communication circuit a2 for the user data traffic forwarding of the second communication circuit a2.
  • the broadband access router sends the online response to the access point 2 through the second communication circuit a2.
  • the broadband access router sends an online response for answering the online request of the access point 2 to the access point 2 through the second communication circuit a2, the user is authenticated, and the second communication circuit a2 is opened to allow traffic forwarding.
  • the group session information table is mainly for the unified management information of the enterprise.
  • the broadband access router performs control management work through the group session information table.
  • the group session information table includes, but is not limited to, unified rate limit authorization (ie, group authorized bandwidth), and unified billing account information.
  • the group session information table does not need to include circuit MAC information, circuit basic information, circuit available bandwidth and other user circuit identification classification information.
  • the unified rate (Group_Speed) value in the group session information should be the rate limit issued by the AAA server when a group user receives an authentication request message for the first time. It should be equal to the sum of the rates of each access circuit (that is, the first communication circuit). Speed1 of a1+Speed2 of the second communication circuit a2+Speed3+ of the third communication circuit a3).
  • the value of the billing account (Group_Account) in the group session information should be equal to the sum of the traffic of each communication circuit (Acout1 of the first communication circuit a1 + Account2 of the second communication circuit a2 + Accout3 of the third communication circuit a3 +...) ,
  • the account information carried in the charging stop message should be reported based on the value of the charging account (Group_Account) in the group session information.
  • the sub-user session information is mainly the circuit information of the communication circuit corresponding to the access point, and network equipment, such as a broadband access router, performs router forwarding work through the telephone session information table.
  • the sub-user session information created by the network device can be in the form of a sub-user session information table.
  • the sub-user session information table includes, but is not limited to, circuit session group identification information, circuit authorized bandwidth (Speed_cir), and circuit charging information (Account) , Circuit MAC information, circuit information (Cir), circuit session identifier (UserID), maximum bearable bandwidth (Speed_Cir).
  • Circuit charging information (Account) is the result of traffic statistics performed independently for each communication circuit. After the circuit bearer users go offline, the charging information is summarized into the charging account (Group_Account) of the group session information table.
  • Table 1 shows a table of seed user session information, please refer to Table 1:
  • the sub-user session information table transfers the authorized circuit bandwidth (Speed_cir) and the circuit charging information (Account) to the group session information table for management, and solves the requirements for unified charging and unified speed limit.
  • the group session information table transfers routing forwarding and circuit control to the circuit session table for processing, and solves the application problems of different mac address forwarding and different circuit bandwidths.
  • the broadband access router accumulates the billing information of each access point where the group user A is currently offline, and deletes the sub-user session information of the second communication circuit a2.
  • the broadband access router After the broadband access router receives the user's offline request, it finds that the access point 2 belongs to the group user type, and checks whether the session is the last access point in the user group to which it belongs. Because access point 2 is not the last offline access point of the group user, the broadband access router only accumulates its billing information and deletes the sub-user session information of the second communication circuit a2, but does not send the billing stop report. Text.
  • the broadband access router disconnects the second communication circuit a2, and the traffic forwarding channel on the second communication circuit a2 is interrupted.
  • the broadband access router periodically sends an accounting update message to the AAA server.
  • the charging update data carried in the charging update message is the sum of the current circuit session traffic of each communication circuit.
  • the broadband access router accumulates the billing information of each access point where the group user A is currently offline, and deletes the sub-user session information of the first communication circuit a1.
  • the broadband access router determines that the access point 1 is the last offline access point of the group user A, and therefore assembles the charging stop message, and deletes the group session information of the group user A.
  • the broadband access router After the broadband access router receives the user's offline request, it finds that the access point 1 belongs to the group user type, checks whether the session is the last session in the group, if it is, accumulates billing information, and deletes the sub-users of the first communication circuit a1 Session information, and assemble the charging stop message.
  • S609 The broadband access router sends an accounting stop message to the AAA server.
  • the charging information in the charging stop message is the sum of the charging information of each circuit.
  • the broadband access router receives the online request of the dual-stack dedicated line user.
  • the direction of the online request can be sent from the user access terminal to the network side egress.
  • the type of the online request can be ipv4 or ipv6 data traffic, ipv4 arp request or ipv6 ND (Neighbor Discovery) request.
  • the broadband access router also needs to process the access request initiated by the Internet interface to the dual-stack private line user. In this case, since the dual-stack private line user has not actively sent the online request, the broadband access router needs to support no arp (no Layer 2 The upload process of the downstream traffic of the MAC corresponding to the ARP table) and the downstream traffic upload of the neighbor discovery process of no nd (there is no Layer 2 MAC corresponding to the ND table) trigger the online process. After the dual-stack dedicated line user accesses, execute S702.
  • the broadband access router generates and sends an authentication request message according to the access information of the dual-stack dedicated line user.
  • the authentication request message needs to be generated according to the Radius protocol, and the user name and password fields are filled in according to the deployment on the broadband access router. Information such as circuit information, access type, and time stamp is filled in according to the access situation.
  • the dual-stack user group information can be declared here, deployed on the broadband access router, or uniformly authorized after being authenticated by the AAA server. After the assembly is complete, execute S703.
  • S703 The broadband access router judges whether the authentication of the AAA server is passed.
  • the AAA server fails to pass the authentication of the authentication request message, the AAA server returns an authentication failure message and ends the process; if the authentication passes, execute S704.
  • the broadband access router stores the authorization information of the user by the AAA server, and judges whether the user type is a group user type of a dual-stack dedicated line.
  • the broadband access router generates a user session table according to the local information.
  • the user session table includes, but is not limited to, local identification information such as session identification information, MAC information, circuit information, user access type, interface type, and interface identification.
  • the broadband access router adds authorization information to the user session table according to the authorization information of the AAA server.
  • Authorization information includes, but is not limited to, authorized bandwidth, authorized use time, authorized use of traffic, and authorized access to services, etc.
  • the broadband access router generates a dual-stack dedicated line user forwarding table.
  • the dual-stack dedicated line user forwarding table includes at least but not limited to user address, network segment address, outbound interface information, routing learning type, routing priority, and user flow.
  • the broadband access router updates the user's upstream and downstream traffic in real time according to the information in the user's forwarding table.
  • the user uplink and downlink traffic updated by the broadband access router includes but is not limited to user uplink bit flow information, user uplink byte information, user downlink bit flow information, and user downlink byte information, execute S716.
  • S709 The broadband access router judges whether the circuit session is the first session of the dedicated line group.
  • the broadband access router generates a group user session table of the dual-stack dedicated line group.
  • the group user session table is mainly used to store user authorization information issued by AAA, including but not limited to group session identification, member session identification, group authorization bandwidth (Group_Speed), authorized use time, authorized use of traffic, and authorized access to services.
  • group authorization bandwidth Group_Speed
  • authorized use time authorized use of traffic
  • authorized access to services The group access authorization for dual-stack dedicated line services is managed uniformly by the group user table.
  • the broadband access router separately generates a sub-user session table for each access session.
  • the sub-user session table is used to store the local information of the circuit on the router device and provide necessary data for traffic forwarding, including but not limited to group session identification information, circuit session identification information, MAC information, circuit information, interface type, interface identification, The maximum bearable bandwidth (Speed_Cir).
  • the broadband access router authorizes information in the forwarding table of each sub-user according to the authorization information of the group session.
  • Dual-stack dedicated line users, group user access type, each access session is based on the authorization information of the group session, but the authorized bandwidth of the circuit of the access session needs to be based on the user's unified authorized speed limit value (Group_Speed) and the circuit can carry The maximum forwarding rate (Speed_cir) is weighted.
  • the authorized bandwidths of the first communication circuit a1, the second communication circuit a2, and the third communication circuit a3 are 137M, 341M, and 546M, respectively.
  • the broadband access router generates a sub-user forwarding table according to the sub-user table information and the sub-user authorized bandwidth information.
  • the business traffic of each sub-user is independently forwarded according to the sub-user forwarding table, and the forwarding is performed according to the key value of port+svlan+cvlan.
  • the table look-up method does not use mac and ip as the key value to solve the problem of the same mac in the group user. Multiple ips, or multiple macs with the same ip, different svlan/cvlans on the same port.
  • the broadband access router updates the upstream and downstream traffic of the sub-user in real time according to the forwarding table information of the sub-user.
  • the sub-user uplink and downlink traffic updated by the broadband access router includes, but is not limited to, sub-user uplink bit flow information, sub-user uplink byte information, sub-user downlink bit flow information, and sub-user downlink byte information.
  • the data information is reported to the group session ledger.
  • the broadband access router updates the session account of the group user in real time according to the sub-user session account information.
  • the broadband access router generates an AAA charging message according to the account information, user session table information, and the Radius standard protocol.
  • the AAA charging message includes but is not limited to charging ID, charging type, circuit information, access type, time stamp, upstream traffic, downstream traffic, etc.
  • the broadband access router sends an accounting start message to the AAA server.
  • the broadband access router will also periodically send accounting update messages to the AAA server during the process of traffic statistics, so that users in non-dual-stack dedicated line groups will be offline or dual-stack dedicated line groups.
  • accounting stop message is sent to the AAA server.
  • S801 Monitor the offline behavior triggered by the dual-stack dedicated line user.
  • Behaviors include active logoff requests initiated by dual-stack dedicated line users, such as active power-off; dual-stack dedicated line user authorization recovery, including but not limited to AAA forcibly removing the user, authorization time out, authorized traffic exceeded, etc.
  • S802 The broadband access router judges whether the offline dual-stack user is the last user of the dual-stack dedicated line group.
  • the broadband access router deletes the sub-user forwarding table corresponding to the corresponding communication circuit.
  • the broadband access router deletes the authorized bandwidth information of the sub-user corresponding to the corresponding communication circuit.
  • the broadband access router deletes the sub-user session table corresponding to the corresponding communication circuit.
  • S806 The broadband access router deletes the group session table.
  • the broadband access router assembles an accounting stop message and sends it to the AAA server.
  • the communication circuit management device 90 includes:
  • the circuit management unit 901 is used for controlling the circuit information used by the dual-stack dedicated line user, and performs bidirectional communication with the dual-stack dedicated line access unit 902.
  • the circuit management unit 901 receives the access request sent by the dual-stack dedicated line user, extracts the access circuit information and reports it to the dual-stack dedicated line access unit 902, and receives the circuit status message sent by the dual-stack dedicated line access unit 902, such as a circuit opening message, Circuit closed message, circuit implementation status information.
  • the circuit management unit 901 is responsible for opening and closing the data service flow of the forwarding management unit 908.
  • the circuit management unit 901 is used to control the circuit information used by the dual-stack dedicated line users.
  • the circuit management unit 901 receives the access request issued by the dual-stack dedicated line user, extracts the access circuit information report, and accepts the circuit status message to control the circuit, such as the circuit opening message, the circuit closing message, and the circuit implementation status information.
  • the circuit management unit 901 is responsible for the opening and closing of data service flow forwarding.
  • the dual-stack dedicated line access unit 902 is used to control the access of dual-stack dedicated line users.
  • the dual-stack dedicated line access unit 902 receives and processes user access requests, extracts access circuit information, and generates dual-stack dedicated line user basic information according to the deployment of the broadband access router.
  • the dual-stack dedicated line access unit 902 is responsible for providing and sending basic information of the dual-stack dedicated line user during the user's online phase, and receiving unified authorization information of the user.
  • the dual-stack dedicated line access unit 902 is responsible for real-time querying of the user's circuit access status and real-time reporting of charging update messages during the user online phase.
  • the dual-stack dedicated line access unit 902 is responsible for sending the dual-stack dedicated line user charging information to the relevant AAA management unit 908 during the user offline phase.
  • the group session management unit 903 is used for group management of dual-stack dedicated line services, and is a device for generating a group session identifier.
  • the group session management unit 903 is responsible for message communication with the dual-stack dedicated line access unit 902, is responsible for the generation and deletion of group user IDs; is responsible for receiving the account content sent by the ledger management unit 905, and is responsible for sending the message content to the dual-stack dedicated line access unit.
  • the circuit session management unit 904 is a circuit session management part for group management of dual-stack dedicated line services, and is an executor of circuit session identification generation.
  • the circuit session management unit 904 is responsible for acquiring required MAC information, circuit information, circuit available bandwidth, etc., sending circuit session identifier UserID, circuit session deleting and adding messages, etc.
  • the circuit session management unit 904 is responsible for sending the charging information to the ledger management unit 905.
  • the ledger management unit 905 is used for the management and calculation of billing ledger information.
  • the ledger management unit 905 receives the charging update information and the charging stop information sent by the circuit session management unit 904, performs calculations, and sends the result to the group session management unit 903.
  • the QOS management unit 906 is used to calculate the QOS message of the circuit and schedule traffic.
  • the QOS management unit 906 is responsible for calculating the reasonable use of bandwidth by the circuit, and putting the bandwidth into different scheduling queues.
  • the QOS management unit 906 is responsible for sending the traffic before and after the scheduling to the forwarding management unit 907.
  • the forwarding management unit 907 is used for routing and forwarding of the broadband access router.
  • the forwarding management unit 907 receives the routing message provided by the dual-stack dedicated line access unit 902.
  • the forwarding management unit 907 receives basic information such as MAC and circuit provided by the circuit session management unit 904.
  • the AAA management unit 908 is used for data interaction with the AAA server.
  • the AAA management unit 908 is used for parsing and assembling the Radius message information of the AAA server.
  • the AAA management unit 908 parses the information content of the AAA server, such as authorization information, and sends the message content to the dual-stack dedicated line access unit 902.
  • the AAA management unit 908 receives the real-time accounting and offline accounting information sent by the dual-stack dedicated line access unit 902, and assembles it into a Radius message and sends it to the AAA server.
  • the dual-stack dedicated line access unit 902 controls the access of dual-stack dedicated line users, receives the user access request sent by the circuit management unit 901, extracts access circuit information, and generates dual-stack dedicated line user basic information according to the deployment of broadband access equipment .
  • the dual-stack private line access unit 902 is responsible for providing basic information of the dual-stack private line user to the AAA management unit 908 during the user online phase, receives the legal user or illegal user message result returned by the AAA management unit 908, and receives the enterprise returned by the AAA management unit 908 User unified authorization information, such as speed limit.
  • the dual-stack dedicated line access unit 902 is responsible for querying the circuit management unit 901 for the user's circuit access status in real time during the user online phase, and reporting the charging update message to the AAA management unit 908 in real time.
  • the dual-stack dedicated line access unit 902 is responsible for sending the dual-stack dedicated line user charging information to the AAA management unit 908 during the user offline phase.
  • the dual-stack dedicated line access unit 902 is responsible for providing the forwarding management unit 907 with forwarding messages required for data forwarding.
  • the dual-stack dedicated line access unit 902 is responsible for providing group information, speed limit information, billing information, MAC information, circuit information, circuit available bandwidth, etc. required for group session management 903.
  • Group session management 903 is used for group management of dual-stack dedicated line services, and is a device for generating group session identifiers.
  • Group session management 903 is responsible for message communication with dual-stack private line access unit 902, responsible for the generation and deletion of group user identification; responsible for receiving the account content sent by the ledger management unit 905, and responsible for sending the message content to the dual-stack private line access Unit 902; responsible for sending unified authorization information to QOS management unit 906; responsible for message intercommunication with circuit session management 904, sending and receiving group information and identification content required for circuit session management, including MAC information, circuit information, circuit available bandwidth, etc.
  • the circuit session management 904 is a circuit session management part used for group management of dual-stack dedicated line services, and is a device for generating circuit session identifiers.
  • the circuit session management 904 is responsible for message communication with the group session management 903, obtaining required MAC information, circuit information, circuit available bandwidth, etc., sending circuit session identifiers, circuit session deletion and adding messages, etc.
  • the circuit session management 904 is responsible for sending the charging information to the ledger management unit 905.
  • the circuit session management 904 is responsible for sending information such as the available bandwidth of the circuit to the QOS management unit 906.
  • the circuit session management 904 is responsible for sending the MAC and basic circuit information required for forwarding to the forwarding management unit 907.
  • the ledger management unit 905 is used for the management and calculation of billing ledger information.
  • the ledger management unit 905 receives the charging update information and the charging stop information sent by the circuit session management 904, performs calculations, and sends the result to the group session management 903.
  • the QOS management unit 906 is used to calculate the QOS message of the circuit and schedule traffic.
  • the QOS management unit 906 receives the messages sent by the group session management 903 and the circuit session management 904, calculates the reasonable use of bandwidth by the circuit, and puts the bandwidth into different scheduling queues.
  • the QOS management unit 906 is responsible for sending the traffic before and after the scheduling to the forwarding management unit 907.
  • the forwarding management unit 907 is used for routing and forwarding of the broadband access router.
  • the forwarding management unit 907 receives the routing message sent by the dual-stack dedicated line access unit 902.
  • the forwarding management unit 907 receives basic information such as mac and circuit sent by the circuit session management 904.
  • the forwarding management unit 907 receives and transmits the scheduling and queue information of the QOS management unit 906.
  • the forwarding management unit 907 assembles the service traffic and delivers it to the circuit management unit 901 for forwarding.
  • the AAA management unit 908 the user performs data interaction with AAA information.
  • the AAA management unit 908 is used to parse the Radius message information of the AAA system of the assembling operator.
  • the AAA management unit 908 analyzes the information content of the operator's AAA system, such as authorization information, and sends the message content to the dual-stack dedicated line access unit 902.
  • the AAA management unit 908 receives the real-time accounting and offline accounting information sent by the dual-stack dedicated line access unit 902, and assembles it into a Radius message and sends it to the AAA server.
  • the communication circuit management device 90 can be deployed on a network device such as a broadband access router.
  • the functions of the circuit management unit 901 and the AAA management unit 908 can be implemented by the processor of the network device and the communication unit.
  • the functions of the dedicated line access unit 902, the group session management unit 903, the circuit session management unit 904, the ledger management unit 905, the QOS management unit 906, and the forwarding management unit 907 can be implemented by the processor of the network device.
  • This embodiment provides a storage medium that can store one or more computer programs that can be read, compiled, and executed by one or more processors.
  • the storage medium can store A communication circuit management program, which can be used by one or more processors to execute the process of implementing any one of the communication circuit management methods introduced in the foregoing embodiments.
  • the network device 100 includes a processor 101, a memory 102, and a communication bus 103 for connecting the processor 101 and the memory 102.
  • the memory 102 may be the aforementioned storage device.
  • the processor 101 can read the communication circuit management program, compile and execute the process for implementing the communication circuit management method introduced in the foregoing embodiment:
  • the processor 101 After receiving an online request initiated by an access point, the processor 101 sends an authentication request message to the AAA server for verifying authorization and accounting according to the online request, and then receives an authentication response message sent by the AAA server indicating that the authentication has passed. If it is determined that the access point belongs to a certain group of users and is the first online access point of the group user, the processor 101 creates the group session information of the group user and opens the communication circuit corresponding to the group user; the group user is shared on the AAA server side A collection of access points with the same group of identification information, the first access point to go online is the first access point that requests to go online, and then the processor 101 manages the communication circuits of the group users based on the group session information.
  • the access point in the group user is an access point using dual protocol stack technology.
  • the processor 101 when the processor 101 opens the communication circuit corresponding to the group of users, it can establish sub-user session information for the communication circuit corresponding to the first online access point, and open the communication circuit corresponding to the first online access point;
  • the processor 101 when the processor 101 turns on the communication circuit corresponding to the group user, it can establish sub-user session information for all the communication circuits corresponding to the group user, and turn on all the communication circuits corresponding to the group user.
  • the processor 101 After the processor 101 establishes sub-user session information for the communication circuit corresponding to the first online access point, when managing the communication circuit of the group user based on the group session information, it can receive an online request initiated by an access point. If it is determined to access If the point is the non-first-online access point of the group user, the sub-user session information is established for the communication circuit corresponding to the access point, and the communication circuit corresponding to the non-first-online access point is turned on.
  • the non-first-online access point is the group user The first access point in Central Africa to request to go online.
  • the processor 101 When the processor 101 manages the communication circuit of the group user based on the group session information, it can receive a logoff request initiated by any access point in the group user; if the access point that initiates the logoff request is not the last logoff of the group user Access point, close the communication circuit of the access point, accumulate the billing information of all offline access points in the group user, and the last offline access point is the last offline access point in the group user.
  • the processor 101 After the processor 101 receives a logoff request initiated by any access point in the group user, if the access point currently initiating the logoff request is the last offline access point of the group user, the communication circuit of the access point is closed, Accumulate the accounting information of all offline access points in the group user, delete the group session information; carry the accumulated accounting information of the group user in the accounting stop message and send it to the AAA server.
  • the processor 101 after the processor 101 receives a logoff request initiated by any access point in the group of users, it can directly close the communication circuit of the access point without judgment, and accumulate all the users in the group. The billing information of the offline access point. Then it is judged whether the access point is the last offline access point of the group user. If it is, the group session information is deleted, and the accumulated accounting information of the group user is carried in the accounting stop message and sent to the AAA server.
  • the processor 101 also determines the group authorized bandwidth uniformly authorized by the AAA server for the group user according to the group session information, and determines the maximum bearable bandwidth of each communication circuit corresponding to the group user, and then according to the group session information.
  • the authorized bandwidth and the maximum bearable bandwidth of each communication circuit determine the circuit authorized bandwidth corresponding to each communication circuit, and control the data flow of each communication circuit according to the circuit authorized bandwidth of each communication circuit.
  • the processor may divide the group speed limit value according to the ratio between the maximum bearable bandwidth of each communication circuit to obtain the circuit authorized bandwidth corresponding to each communication circuit.
  • the processor when the processor determines that the access point belongs to a certain group of users, it can determine that the access point belongs to a certain group of users according to the mapping relationship between the group users and each communication circuit stored locally; or according to AAA
  • the server authentication response message determines that the access point belongs to a certain group of users, and the AAA server stores the mapping relationship between the group users and each communication circuit.
  • the network device after receiving an online request initiated by an access point, sends an authentication request message to the authentication authorization accounting AAA server according to the online request; the authentication is determined according to the authentication response table sent by the AAA server After passing, it is determined that the access point belongs to a certain group of users and is the first online access point of the group user, then the group session information of the group user is created, the communication circuit corresponding to the group user is opened, and the communication of the group user based on the group session information The circuit is managed.
  • the concept of "group users" is proposed to uniformly manage all communication circuits belonging to the same owner (for example, an enterprise), so that the access points corresponding to each communication circuit belonging to the same owner are used differently.
  • the communication circuit management method, network equipment, and storage medium provided by the embodiments of the present application, after receiving an online request initiated by an access point, send an authentication request message to the authentication authorization accounting AAA server according to the online request; After the authentication response form sent by the server confirms that the authentication is passed, it is determined that the access point belongs to a certain group of users and is the first online access point of the group user, then the group session information of the group user is created, and the communication circuit corresponding to the group user is opened. Manage the communication circuits of group users based on group session information.
  • the concept of "group users" is proposed to uniformly manage all communication circuits belonging to the same owner (for example, an enterprise), so that the access points corresponding to each communication circuit belonging to the same owner are used differently.
  • the functional modules/units in the system, and the device can be implemented as software (which can be implemented by the program code executable by the computing device) , Firmware, hardware and their appropriate combination.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively.
  • Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • the computer-readable medium may include computer storage. Medium (or non-transitory medium) and communication medium (or temporary medium).
  • medium or non-transitory medium
  • communication medium or temporary medium
  • the term computer storage medium includes volatile and non-volatile data implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media.
  • Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other storage technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer.
  • communication media usually contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery media. . Therefore, this application is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供一种通讯电路管理方法、网络设备及存储介质，接收到某一接入点发起的上线请求后，根据上线请求向验证授权记账AAA服务器发送认证请求报文；根据AAA服务器发送的认证应答表文确定认证通过后，确定接入点属于某一组用户，且为组用户的首上线接入点，则创建组用户的组会话信息，开启组用户对应的通讯电路，基于组会话信息对组用户的通讯电路进行管理。

Description

一种通讯电路管理方法、网络设备及存储介质
相关申请的交叉引用
本申请基于申请号为201910964911.9、申请日为2019年10月11日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请涉及通信领域，尤其涉及一种通讯电路管理方法、网络设备及存储介质。
背景技术
在宽带接入路由器上，专线接入业务是指将某个以太网接口或者接口下的某些VLAN(Virtual Local Area Network，虚拟局域网)整体出租给一组用户使用的业务。一条专线下可以接入多台设备，但是在宽带接入路由器上只表现为一个用户，运营商实际上对专线进行统一的认证计费、企业带宽、访问权限等控制。
随着专线用户业务规模的发展，以及双栈地址扩容后的业务变化，专线接入业务出现了接入方式的变更：企业从只使用一个以太网接口或接口下的某些VLAN接入，演变成使用多个不同的以太网接口或不同以太网接口下的VLAN接入；企业从单一地址出口，演变成单一出口多个双栈地址或多个出口多个双栈地址。这样网络侧，如AAA(Authentication、Authorization、Accounting，验证授权记账)服务器，在对同一企业的专线接入业务进行管理的时候，也会相应的采用多个管理账号进行管理，这不仅导致网络侧需要维护、管理大量管理账号，管理负担大的问题，而且，也会给企业在使用专线接入或者为专线缴费等过程中造成很多不便。
发明内容
本申请实施例提供的通讯电路管理方法、网络设备及存储介质。
本申请实施例提供一种通讯电路管理方法，包括：接收到某一接入点发起的上线请求后，根据上线请求向验证授权记账AAA服务器发送认证请求报文；接收AAA服务器发送的表征认证通过的认证应答报文；若确定接入点属于某一组用户，且为组用户的首上线接入点，则创建组用户的组会话信息，开启组用户对应的通讯电路；组用户为在AAA服务器侧共用组标识信息的各接入点的集合，首上线接入点为首个请求上线的接入点；基于组会话信息对组用户的通讯电路进行管理。
本申请实施例还提供一种网络设备，该网络设备包括处理器、存储器及通信总线；通信总线用于实现处理器和存储器之间的连接通信；处理器用于执行存储器中存储的一个或者多个程序，以实现上述通讯电路管理方法的步骤。
本申请实施例还提供一种存储介质，其中，存储介质存储有一个或者多个程序，一个或者多个程序可被一个或者多个处理器执行，以实现上述通讯电路管理方法的步骤。
本发明本申请其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本申请说明书中的记载变的显而易见。
附图说明
图1为本申请实施例一中提供的通讯电路管理方法的一种流程图；
图2a为本申请实施例一中提供的网络设备对组用户进行下线管理的一种流程图；
图2b为本申请实施例一中提供的网络设备对组用户进行下线管理的另一种流程图；
图3为本申请实施例一中提供的网络设备对组用户进行限速管理的一种流程图；
图4为本申请实施例二中提供的企业A的专线接入业务示意图；
图5为本申请实施例二中提供的组用户中接入点上线的一种交互流程图；
图6为本申请实施例二中提供的组用户中接入点下线的一种交互流程图；
图7为本申请实施例二中提供的通讯电路管理方案中接入点上线的一种流程图；
图8为本申请实施例二中提供的通讯电路管理方案中接入点下线的一种流程图；
图9为本申请实施例三中提供的通讯电路管理装置的一种结构示意图；
图10为本申请实施例四中提供的网络设备的一种硬件结构示意图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本申请实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请实施例提供的通讯电路管理方法、网络设备及存储介质，主要解决的技术问题是：相关技术中宽带接入路由器对使用多个不同的以太网接口或不同以太网接口下的VLAN接入的同一企业的专线的管理复杂，造成企业与运营商的管理负担大的问题。
实施例一：
专线根据接入方式的不同，可以分为二层专线及三层专线。二层专线通过数据通讯类二层设备，如交换机接入宽带接入路由器的某个接口或者接口的VLAN下，地址的分配由宽带接入路由器进行，专线下用户的业务按照专线的业务控制策略进行控制，流量全部采集在专线上，对专线统一作带宽限制。三层专线通过数据通讯的三层设备，如企业级路由器，接入到宽带接入路由器的某个接口或者接口的VLAN下，此时地址分配由企业级路由器完成，宽带接入设备担当转发功能，但专线下的各个终端用户的业务按专线的业务控制策略进行控制，流量全部采集在专线上，对专线统一作带宽限制。
为了解决网络演进过程中相关技术，如因为一个专线拥有者单一出口出现多个双栈接入地址或一个专线拥有者出现多个出口多个双栈接入地址，使得专线拥有者、运营商不得不改变原有运维部署方式的情况，分设不同管理策略进而使得网络侧管理负担大，用户侧专线业务体验不高的问题，本实施例提供一种通讯电路管理方法，请参见图1示出的流程图：
S102：网络设备接收到某一接入点发起的上线请求后，根据上线请求向AAA服务器发送认证请求报文。
在本实施例中，网络设备可以为宽带接入路由器等，其与AAA服务器通信连接，同时还可以与接入点通过通讯电路通信连接。可以理解的是，在实际网络中，网络设备与接入点中间还可以经过汇聚、固网一系列物理设备，并不一定是物理直连。
所谓接入点可以是企业级路由器等NAT(Network Address Translation，网络地址转换)设备，接入点一方面通过通讯电路(例如企业专线)接入到宽带接入路由器等网络设备下，另一方面可以提供一个局域网，供处于该局域网范围内的终端设备，例如手机、平板等通过无线的方式接入，或者是台式电脑等通过有线方式接入，从而实现终端设备与因特网的互联。
可以理解的是，专线用户包括但不限于企业，也可以包括组织或者是其他需要使用专线接入业务的机构。在本实施例中，一个专线用户可以拥有一个或多个接入点。当某一接入点上有用户接入的时候，该接入点就会向网络设备发起上线请求，所以，对于网络设备而言，其接收到的上线请求可以是来自仅拥有一个接入点的专线用户，也可以是来自拥有至少两个接入点的专线用户。在接收到来自某一接入点的上线请求之后，网络设备可以根 据该上线请求组装认证请求报文，并将该认证请求报文发送到AAA服务器处，由AAA服务器对该接入点进行身份认证。
S104：网络设备接收AAA服务器发送的表征认证通过的认证应答报文。
在AAA服务器接收到认证请求报文之后，进行数据库查询，以确定认证请求报文中的用户信息是否合法，若确定认证请求中的用户信息合法，则向网络设备反馈表征认证通过的认证应答报文。在本实施例的一些示例中，如果AAA服务器通过查询，确定认证请求报文中携带的用户信息不合法，则可以向网络设备发送表征认证失败的消息。当然在其他一些示例当中，若AAA服务器接收到认证请求报文后认证失败，则其可以不必向网络设备反馈任何信息，这样，网络设备因为没有接收到表征认证通过的认证应答报文，因此也不会开通对应接入点的通讯电路。
可以理解的是，组用户的特征，例如组用户中所包含的接入点的信息等可以在认证过程中由AAA服务器下发给宽带接入服务器，或者由宽带接入服务器配置在其本地。
S106：若确定接入点属于某一组用户，且为组用户的首上线接入点，则创建组用户的组会话信息，开启组用户对应的通讯电路。
在确定AAA服务器的认证通过之后，如果网络设备确定该接入点属于某一组用户，并且确定该接入点是该组用户中第一个请求上线的接入点，也即是首上线接入点，则网络设备可以为该组用户创建组会话信息，并开启该组用户对应的通讯电路。
所谓“组用户”，是指在AAA服务器侧共用同一组标识信息的各接入点的集合。所谓组标识信息是指可以在AAA服务器侧与网络设备侧唯一区分一个组用户的信息，例如组用户名，组ID号等。需要说明的是，虽然组用户是共用同一组标识信息的各接入点的集合的接入点的集合，但这并不意味着组用户中一定同时包括两个或多个接入点，一个组用户中当然可以同时包括至少两个接入点，但在另外一些示例当中，组用户也可以仅包括一个接入点。因此，接入点的数目不是决定是否可以构成组用户的条件。
在本实施例中，组用户中的接入点为使用双协议栈技术的接入点，简称双栈接入点，因此组用户也可以称为双栈组用户。
另外，一个组用户中的各个接入点在AAA服务器侧可以拥有不同网络管理账号，对于这一点，类似于手机家庭套餐，个人的手机号码都是独立的，但是统一收费，共享套餐。简单来说，组用户可以被理解成一个专线用户，也即专线拥有者。例如，假定企业A在x地与y地都有子企业，分别是子企业A1与子企业A2，为了便于企业用网，企业A为子企业A1与子企业A2都开通了专线，分别是专线a1与专线a2。按照相关技术中的管理方案，AAA服务器会分别按照子企业A1对应的网络管理账号管理专线a1，按照子企业A2对应的网络管理账号管理专线a2。这样，专线a1与专线a2的流量带宽分配、计费等方面都是相互独立的，对于企业A而言，其拥有两条完全独立的专线，在为两条专线缴费的时候，企业A需要分别缴费。但在本实施例中，因为提出了“组用户”的概念，因此，子企业A1与子企业A2各自的接入点同属一个组用户，AAA服务器将子企业A1与子企业A2关联，为二者配置同样的组标识信息，而AAA服务器、宽带接入服务器可以基于该组用户的组标识信息对这两条专线进行统一的流量带宽分类、计费等。
在本实施例的一些示例当中，网络设备需要基于AAA服务器反馈的认证应答报文才能确定该接入点是否属于组用户。在这些示例当中，AAA服务器侧存储有各通讯电路与组用户之间的映射关系，应当理解的是，通讯电路与接入点之间是唯一对应的，因此，可以认为AAA服务器存储有接入点与组用户之间的映射关系，这样，当AAA服务器从网络设备处接收到针对该接入点的认证请求报文之后，通过查询该映射关系，可以确定该接入点属于组用户。在AAA服务器对该接入点的认证通过之后，其可以在认证应答报文中携带该接入点所属组用户的组信息，网络设备在接收到认证应答报文之后，就可以根据其中的组信息确定当前请求上线的接入点属于一个组用户。
在本实施例的其他一些示例当中，网络设备在确定当前请求上线的接入点是否属于组 用户时，并不需要依赖AAA服务器反馈的认证应答报文，因为在这些示例当中，网络设备自己就可以维护各通讯电路与组用户之间的映射关系，如此，当接收到某一接入点发起的上线请求之后，网络设备就可以通过查询其本地存储的映射关系，从而确定该接入点是否是组用户中的一个成员。
在本实施例中，如果网络设备确定当前请求上线的接入点属于某一个组用户，并且确定该接入点是该组用户的“首上线接入点”，则该网络设备可以为该组用户创建组会话信息，该组会话信息主要用于对该组用户进行统一授权及流量统计等。
所谓“首上线接入点”，是指一个组用户中第一个请求上线的接入点，毫无疑义的是，在一个组用户中，只会有一个首上线接入点，除了首上线接入点以外，组用户中其余的接入点都是“非首上线接入点”，也即不是第一个请求上线的接入点。应当理解的是，通常情况下，一个组用户的首上线接入点并不是固定的，例如，如果一个组用户A中有A1、A2与A3三个成员，则在某些情况下，A1可能是第一个请求上线的接入点，而在另外一些情况下，A2可能是第一个请求上线的接入点，但在另外一些情况下，A3才是首上线接入点。
在创建组用户对应的组会话信息之后，网络设备可以为组用户对应的通讯电路创建子用户会话信息，并开启对应的通讯电路。可以理解的是，开启的通讯电路应当包含首上线接入点所对应的通讯电路，创建的子用户会话信息自然也应当包含与首上线接入点对应的通讯电路的电路会话信息。
所谓子用户会话信息可以用于用户数据的流量转发及细化管理。子用户会话信息主要为接入点对应的通讯电路的电路信息，网络设备，如宽带接入路由器，通过电话会话信息表进行路由器转发方面的工作。网络设备创建的子用户会话信息可以为子用户会话信息表的形式，在子用户会话信息表中包含但不限于电路会话的组标识信息、电路授权带宽(Speed_cir)、电路计费信息(Account)、电路MAC信息、电路信息(Cir)、电路会话标识(UserID)、最大可承载带宽(Speed_Cir)。
S108：网络设备基于组会话信息对组用户的通讯电路进行管理。
在网络设备创建组用户的组会话信息，开启组用户对应的通讯电路，之后，其可以基于组会话信息对组用户的通讯电路进行管理，例如，对该组用户中其他接入点(也即非首上线接入点)的上线管理、对组用户中接入点的下线管理、对组用户流量的统计管理以及对组用户中接入点的限速管理等。下面分别对这几方面的管理进行阐述：
第一，对非首上线接入点的上线管理：
在本实施例的网络设备在根据AAA服务器对首上线接入点的认证应答报文开启组用户对应的通讯电路的时候，可以仅开启首上线接入点对应的通讯电路，因此，在创建子用户会话信息的时候，也仅先创建首上线接入点所对应的通讯电路的子用户会话信息。在后续过程中，如果接收到非首上线接入点发送的上线请求之后，再为非首上线接入点对应的通讯电路创建子用户会话信息，并开启该非首上线接入点对应的通讯电路。毫无疑义的是，因为组会话信息是以组用户为单位创建的，因此一个组用户仅有一个组会话信息，故，当非首上线接入点上线的时候，网络设备就不必再为非首上线接入点所对应的组会话创建组会话信息，而是让非首上线接入点继承首上线接入点上线时创建的组会话信息。
在本实施例的另外一些示例当中，网络设备在根据AAA服务器对首上线接入点的认证应答报文开启组用户对应的通讯电路的时候，可以开启该组用户对应的全部通讯电路。在这种情况下，网络设备需要为该组用户的所有通讯电路创建对应的子用户会话信息。不过，可以理解的是，虽然开启了全部的通讯电路，但因为目前上线的只有首上线接入点，因此，只有首上线接入点上有流量的传输。对于非首上线接入点，如果有用户接入，则可以直接开始使用网络，非首上线接入点无须发起上线请求。
在本实施例的一些示例当中，在某一个接入点上线的时候，网络设备可以根据组会话信息确定该接入点属于一组用户，并且确定该接入点并非是其所属组用户的首上线接入点，因此，AAA服务器之前已经对该接入点所属的组用户中的首上线接入点进行过认证， 因此，AAA服务器可以不必再对当前请求上线的接入点进行认证，因此，网络设备在接收到该接入点发送的上线请求的时候，不需要根据上线请求向AAA服务器发送认证请求报文，就可以直接创建该接入点对应的子用户会话信息，并开启对应的通讯电路。
在本实施例的另外一些示例当中，网络设备在接收到上线请求之后，并不会判断当前请求上线的接入点是否是组用户下的成员，在这种情况下，网络设备对于其接收到的各个上线请求，都会生成对应的认证请求报文并发送到AAA服务器处，由AAA服务器进行认证。网络设备只有在接收到AAA服务器反馈的表征认证通过的认证应答报文之后才会根据认证应答报文的内容确定当前请求上线的接入点是否属于组用户，如果是组用户，则判断是否已经存在对应的组会话信息，如果不存在对应的组会话信息，则说明该接入点是其组用户的首上线接入点，因此，网络设备生成对应的组会话信息，并生成对应的子用户会话信息，开启对应的通讯电路；如果存在，则说明该接入点不是其所属组用户的首上线接入点，因此，可以不必再生成组会话信息，而是直接生成对应通讯电路的子用户会话信息，开启对应的通讯电路。
第二，对组用户中接入点的下线管理及流量统计管理：
如果将组用户中首上线用户的上线作为组用户的上线时刻，则组用户的下线时刻应当是组用户中最后一个接入点下线的时刻，这样才能保证组用户下的用户能够正常使用网络。在本实施例中，将组用户中最后一个下线的接入点称为“末下线接入点”。所以，当组用户中存在接入点请求下线的时候，基于该接入点是否是末下线接入点，网络设备可以参照以下管理方案进行管理，请结合图2a示出的流程图：
S200：接收组用户中任意一个接入点发起的下线请求。
可以理解的是，无论组用户中各接入点上线的顺序如何，各接入点的下线顺序与上线顺序并无关系，因此，网络设备接收接入点的下线请求的时候，并不能确保以何种顺序接收到下线请求。所以，下线请求可以是组用户中任意一个接入点发起的。
S202：判断当前发起下线请求的接入点是否是组用户的末下线接入点。
若判断结果为是，则进入S206，否则进入S204。
S204：关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息。
如果经过网络设备的判断确定当前请求下线的接入点并不是其所属组用户的末下线接入点，则说明在当前情况下，尚不能让整个组用户下线，因此，网络设备仅仅关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息，删除当前下线接入点的子用户会话信息。
S206：关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息，删除组会话信息。
如果经过网络设备的判断确定当前请求下线的接入点是其所属组用户的末下线接入点，则说明该组用户的所有接入点都已经下线了，因此可以让整个组用户都下线，故，网络设备不仅会关闭该接入点的通讯电路累计组用户中所有已下线的接入点的计费信息，删除当前下线接入点通讯电路的子用户会话信息，还会删除组会话信息。
S208：将累计的组用户的计费信息携带在计费停止报文中发送给AAA服务器。
在确定一个组用户中全部的接入点都下线之后，网络设备可以将累计的该组用户对应的计费信息发送给AAA服务器，通常情况下，网络设备可以通过计费停止报文向AAA服务器发送自己所累计的计费信息。AAA服务器接收到计费停止报文之后，根据其中的计费信息就可以确定对应组用户总体的流量使用情况，这样，AAA可以基于一个组用户来管理一个拥有多条通讯电路的拥有者，例如企业的网络缴费，无论是对网络侧还是对通讯电路的拥有者而言，都更方便。
在前述示例当中，当组用户中的一个接入点发起下线请求之后，网络设备是先对该接入点是否是末下线接入点进行判断，然后再根据请求下线的接入点的类型来执行后续操作。但可以理解的是，无论请求下线的接入点是否是组用户的末下线接入点，网络设备都 会关闭该接入点对应的通讯电路，累计当前已下线的接入点的计费信息，然后删除该接入点对应的子用户会话信息。不同的是，如果是末下线接入点，网络设备会对组会话信息进行处理，也会发送计费停止报文，而如果该接入点不是末下线接入点，则网络设备不会进行后面的两个动作，因此，本实施例还提供一种下线管理及流量统计管理方案，请参见图2b：
S210：接收组用户中任意一个接入点发起的下线请求；
S212：关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息；
S214：判断接入点是否是组用户的末下线接入点.
若是，则执行S216，否则，继续执行S210。
S216：删除组会话信息，并将累计的组用户的计费信息携带在计费停止报文中发送给AAA服务器。
第三，对组用户中接入点的限速管理：
在本实施例中，因为针对属于同一拥有者的通讯电路基于组用户的概念进行统一管理，因此，在本实施例中，可以对同一拥有者的数据流量进行统一的授权限速管理，请参见图3示出的流程图：
S302：根据组会话信息确定AAA服务器为组用户统一授权的组授权带宽，并确定组用户所对应的各通讯电路的最大可承载带宽。
在本实施例中，组会话信息中限定了组用户的组授权带宽，该组授权带宽是由AAA服务器为一个组会话同一授权的，表示该组用户在同一时刻的最大流量带宽。所以网络设备可以根据组会话信息确定出AAA服务器为组用户统一授权的组授权带宽。
对于每个通讯电路，都有其最大可承载带宽，各通讯电路最大可承载带宽的值可以预置于网络设备处，所以，在网络设备为各通讯电路生成的子用户会话信息中可以包含其对应的最大可承载带宽，因此，网络设备也可以确定出组用户所对应的各通讯电路的最大可承载带宽。
S304：根据组授权带宽与各通讯电路的最大可承载带宽确定各通讯电路所对应的电路授权带宽。
在本实施例的一些示例当中，网络设备可以根据各通讯电路的最大可承载带宽之间的比值划分组限速值得到各通讯电路所对应的电路授权带宽。例如，假定一个组用户的组授权带宽为Speed，组用户中包括A1与A2两个接入点，这两个接入点各自对应的通讯电路分别是a1与a2，且a1的最大可承载带宽为200M，a2的最大可承载带宽为400M，则这两个通讯电路最大可承载带宽之间的比值为1:2，因此，按照1:2的比例对Speed进行划分，通讯电路a1可以得到的电路授权带宽是Speed/3，而通讯电路a2可以得到的电路授权带宽是2*Speed/3。
应当理解的是，网络设备根据组授权带宽与各通讯电路的最大可承载带宽确定各通讯电路所对应的电路授权带宽的方式不限于上述示例中的这一种。
S306：按照各通讯电路的电路授权带宽控制各通讯电路的数据流量。
在确定出各通讯电路的电路授权带宽之后，网络设备可以按照各通讯电路的电路授权带宽控制各通讯电路的数据流量。
本申请实施例提供的通讯电路管理方法，基于组用户的概念对同一拥有者的一条或至少两条通讯电路进行统一的上线、下线、限速、流量统计管理，使得AAA服务器侧无须再对不同接入点对应的通讯电路进行非单独的计费、限速等，有利于降低AAA服务器侧的管理负担，也有利于提升拥有者的专线接入业务的使用体验。
实施例二：
本实施例将结合示例继续对前述通讯电路管理方法进行说明，以使本领域的技术人员 能够更清楚该通讯电路管理方法的优点与细节：
请参见图4，企业A随着企业规模的扩展，业务呈现多地域化的特点，企业先后开通了第一通讯电路a1、第二通讯电路a2、第三通讯电路a3这三条不同的单栈或双栈业务专线，作为企业日常工作的数据通讯通道。
企业A办理的为总量1G速率宽带，在宽带服务承建方的运营系统及AAA服务器侧的AAA台账系统中表现为一个企业账号，因此采用相同账号下的速率进行授权、采用相同账号下的信息进行记账。因此出现不同物理链路接入，统一记账及策略管理的要求。
在宽带接入路由器上，企业A开通的第一通讯电路a1、第二通讯电路a2均从相同物理端口Port1接入，但采用了不同Svlan(Service VLAN，服务VLAN)、Cvlan(Customer VLAN，用户VLAN)的电路进行业务区分；企业A开通的第二通讯电路a2、第三通讯电路a3从不同的物理端口接入，第二通讯电路a2采用物理端口Port1+Svlan2+Cvlan2，第三通讯电路a3采用物理端口Port3+Svlan3+Cvlan3。因此出现了跨物理端口、跨电路、甚至跨不同物理单板接入情景。
在宽带接入路由器40上，三个接入点，即接入点1、接入点2使用MAC1作为物理链路层的二层通讯地址，接入点3使用MAC3作为物理链路层的二层通讯地址。因此出现了企业不同接入点，接入MAC可能相同，可能不同的接入情况。
在宽带接入路由器40上，接入点1预置了200M的电路带宽；接入点2预置了500M的电路带宽；接入点3预置了800M的电路带宽。因此出现企业1G带宽，在不同电路上合理分配双栈速率的要求。
本实施例为宽带接入路由器提供群组化接入解决方案，有效解决不同端口统一进行策略管理问题，包含但不限于不同物理电路的接入策略、不同电路的带宽分配策略、统一计费策略、不同或相同MAC的接入问题。
下面请参见图5示出的通讯电路管理方法中，接入点上线的一种流程示意图：
S501：接入点1存在用户接入请求时，向宽带接入路由器发送上线请求。
宽带接入路由器，也可以称为MSE(MSE，多服务边缘)设备。
S502：宽带接入路由器接收上线请求后，组装填充认证请求报文，并将认证上线请求报文发送至AAA服务器。
S503：AAA服务器进行数据库查询。
S504：AAA服务器向宽带接入路由器发送认证应答报文。
AAA服务器经过查询发现认证请求报文中的用户信息合法，则向宽带接入路由器发送表征认证通过的认证应答报文。
S505：宽带接入路由器生成组会话信息，同时为第一通讯电路a1生成子用户会话信息。
宽带接入路由器对认证应答报文进行处理，确定第一通讯电路a1上线的用户类型为双栈组用户类型，接入点1属于组用户A，并且确定接入点1是组用户A的首上线接入点，因此，宽带接入路由器为组用户A生成组会话信息，同时为第一通讯电路a1生成子用户会话信息。组会话用于用户的统一授权及流量统计；子用户会话信息用于用户数据的流量转发及细化管理。
S506：宽带接入路由器将上线响应通过第一通讯电路a1发送给接入点1。
用户认证通过，第一通讯电路a1开通允许流量转发。
S507：接入点2存在用户接入请求时，向宽带接入路由器发送上线请求。
S508：宽带接入路由器接收上线请求后，为第二通讯电路a2生成子用户会话信息。
确定接入点2接收到接入点2发送的上线请求后，根据上线请求以及组会话信息确定接入点2属于组用户A，且已经存在该组的组会话信息，因此宽带接入路由器将不向AAA服务器发送针对接入点2的认证请求报文，宽带接入路由器生成第二通讯电路a2的子用户会话信息，用于第二通讯电路a2用户数据流量转发。
S509：宽带接入路由器将上线响应通过第二通讯电路a2发送给接入点2。
宽带接入路由器将用于应答接入点2的上线请求的上线响应通过第二通讯电路a2发送给接入点2，用户认证通过，第二通讯电路a2开通允许流量转发。
组会话信息表，主要为企业统一管理信息，宽带接入路由器通过组会话信息表进行控制方面管理工作。组会话信息表包含但不限于统一限速授权(即组授权带宽)，统一计费的台账信息。组会话信息表，无需包含电路MAC信息，电路基本信息，电路可用带宽等用户电路识别的分类信息。组会话信息中统一速率(Group_Speed)数值应该为AAA服务器在针对一个组用户第一次收到认证请求报文时下发的限速速率，应等于各个接入电路的速率和(即第一通讯电路a1的Speed1+第二通讯电路a2的Speed2+第三通讯电路a3的Speed3+...)。组会话信息中计费台账(Group_Account)数值，应等于各个通讯电路的流量和(第一通讯电路a1的Accout1+第二通讯电路a2的Account2+第三通讯电路a3的Accout3+......)，计费停止报文中携带的台账信息应取组会话信息中计费台账(Group_Account)数值进行上报。
子用户会话信息主要为接入点对应的通讯电路的电路信息，网络设备，如宽带接入路由器，通过电话会话信息表进行路由器转发方面的工作。网络设备创建的子用户会话信息可以为子用户会话信息表的形式，在子用户会话信息表中包含但不限于电路会话的组标识信息、电路授权带宽(Speed_cir)、电路计费信息(Account)、电路MAC信息、电路信息(Cir)、电路会话标识(UserID)、最大可承载带宽(Speed_Cir)。电路计费信息(Account)是每条通讯电路独立进行流量统计的流量统计结果，在电路承载用户下线后将计费信息汇总入组会话信息表的计费台账(Group_Account)。表1示出了一种子用户会话信息表，请参见表1：
表1
Figure PCTCN2020112621-appb-000001
子用户会话信息表将电路授权带宽(Speed_cir)、电路计费信息(Account)统一交由组会话信息表进行管理，解决统一计费、统一限速方面的需求。
组会话信息表将路由转发及电路控制交由电路会话表进行处理，解决不同mac地址转发、不同电路带宽分别的应用问题。
下面请参见图6示出的通讯电路管理方法中，接入点下线的一种流程示意图：
S601：接入点2在用户需要下线时，向宽带接入路由器发送下线请求。
S602：宽带接入路由器累计组用户A当前已下线的各接入点的计费信息，并删除第二通讯电路a2的子用户会话信息。
宽带接入路由器收到用户下线请求后，发现接入点2属于组用户类型，检查该会话是否是其所属用户组中最后一个请求下线的接入点。因为接入点2并不是组用户的末下线接入点，因此，宽带接入路由器仅仅累计其计费信息，并删除第二通讯电路a2的子用户会话 信息，但不发送计费停止报文。
S603：宽带接入路由器断开第二通讯电路a2，第二通讯电路a2上的流量转发通道中断。
S604：宽带接入路由器定期向AAA服务器发送计费更新报文。
计费更新报文中携带的计费更新数据是各通讯电路当前电路会话的流量和。
S605：AAA服务器返回计费确认消息。
S606：接入点1的用户需要下线时，向宽带接入路由发送下线请求。
S607：宽带接入路由器累计组用户A当前已下线的各接入点的计费信息，删除第一通讯电路a1的子用户会话信息。
S608：宽带接入路由器确定接入点1是组用户A的末下线接入点，因此组装计费停止报文，删除组用户A的组会话信息。
宽带接入路由器收到用户下线请求后，发现接入点1属于组用户类型，检查该会话是否是组中最后一个会话，如果是则累计计费信息，删除第一通讯电路a1的子用户会话信息，并组装计费停止报文。
S609：宽带接入路由器将计费停止报文发送给AAA服务器。
计费停止报文中的计费信息为各电路计费信息总和。
S610：AAA服务器返回计费确认消息。
下面结合附图与示例对前述通讯电路管理方法做详细阐述。如图7所示，为本申请双栈专线业务群组化统一管理的处理流程图，包括以下步骤：
S701：宽带接入路由器接收双栈专线用户的上线请求。
上线请求发出的方向可以为用户接入端发往网络侧出口，上线请求的类型可以为ipv4或ipv6数据流量，可以为ipv4的arp请求或为ipv6的ND(Neighbor discovery，邻居发现)请求。宽带接入路由器同样需要处理，互联网接口向双栈专线用户发起的访问请求，此种情况下，由于双栈专线用户还未主动发送上线请求，需要由宽带接入路由器支持no arp(无二层MAC对应ARP表)的下行流量上送流程及no nd(无二层MAC对应ND表)的邻居发现流程的下行流量上送触发上线过程。双栈专线用户接入后，执行S702。
S702：宽带接入路由器根据双栈专线用户的接入信息生成并发送认证请求报文。
认证请求报文需要按照Radius协议生成，其中用户名、密码字段按照宽带接入路由器上的部署进行填充。电路信息、接入类型、时间戳等信息按照接入情况填充。双栈用户组信息可在此处进行申明，在宽带接入路由器上进行部署，或由AAA服务器认证通过后统一进行授权。组装完成后，执行S703。
S703：宽带接入路由器判断AAA服务器的认证是否通过。
如果AAA服务器对认证请求报文的认证不通过，则AAA服务器返回认证不通过消息，结束流程；如果认证通过，执行S704。
S704：宽带接入路由器存储AAA服务器对该用户授权信息，并判断该用户类型是否为双栈专线的组用户类型。
若果判断结果为是，则执行S709；如果不是双栈专线组用户，执行S705。
S705：宽带接入路由器根据本地信息生成用户会话表。
用户会话表中包含但不限于会话标识信息、MAC信息、电路信息、用户接入类型、接口类型、接口标识等本地标识信息。
S706：宽带接入路由器根据AAA服务器的授权信息在用户会话表中增加授权信息。
授权信息包含但不限于授权带宽、授权使用时间、授权使用流量以及授权访问业务等。
S707：宽带接入路由器生成双栈专线用户转发表。
根据用户会话表信息，路由接口信息生成双栈专线用户转发表，双栈专线用户转发表至少包含但不限于用户地址、网段地址、出接口信息、路由学习类型、路由优先级、用户流。
S708：宽带接入路由器根据用户转发表内信息实时更新用户上下行流量。
宽带接入路由器更新的用户上下行流量，包含但不限于用户上行bit流量信息、用户上行字节信息、用户下行bit流量信息、用户下行字节信息，执行S716。
S709：宽带接入路由器判断该电路会话是否为专线组的第一个会话。
若判断结果为是，则执行S710，否则执行S711。
S710：宽带接入路由器生成双栈专线组的组用户会话表。
组用户会话表主要用于存储AAA下发的用户授权信息，包含但不限于组会话标识，成员会话标识，组授权带宽(Group_Speed)，授权使用时间，授权使用流量，授权访问业务。双栈专线业务群组化接入的授权，由组用户表统一进行管理。
S711：宽带接入路由器对每个接入会话单独生成子用户会话表。
子用户会话表用于存储该电路在路由器设备上的本地信息，为流量转发提供必要数据，包含但不限于组会话标识信息，电路会话标识信息、MAC信息、电路信息、接口类型、接口标识、最大可承载带宽(Speed_Cir)。
S712：宽带接入路由器根据组会话的授权信息在各子用户转发表中授权信息。
双栈专线用户，组用户接入类型，每个接入会话均以组会话的授权信息为主，但接入会话的电路授权带宽需要根据用户统一授权的限速值(Group_Speed)及电路可承载的最大转发速率(Speed_cir)进行加权计算。以第一通讯电路a的电路授权带宽计算为例：
第1通讯电路的电路授权带宽
＝Group_Speed*[Speed1_cir/(Speed1_cir+Speed2_cir+Speed3_cir)]
所以，当组用户A的组授权带宽为1G时，第一通讯电路a1、第二通讯电路a2以及第三通讯电路a3，各自的电路授权带宽分别为137M、341M、546M。
S713：宽带接入路由器根据子用户表信息与子用户授权带宽信息生成子用户转发表。
对于各子用户的业务流量根据子用户转发表进行独立转发，转发依据port+svlan+cvlan的键值进行查表，不使用mac与ip作为键值的查表方式，解决组用户内部，相同mac多个ip、或相同ip多个mac、相同port不同svlan/cvlan的情况。
S714：宽带接入路由器根据子用户转发表信息，实时更新子用户上下行流量。
宽带接入路由器更新的子用户上下行流量包含但不限于子用户上行bit流量信息、子用户上行字节信息、子用户下行bit流量信息、子用户下行字节信息。数据信息上报组会话台账。
S715：宽带接入路由器根据子用户会话台账信息，实时更新组用户的会话台账。
S716：宽带接入路由器根据台账信息、用户会话表信息，Radius标准协议，生成AAA计费消息。
AAA计费消息中包含不限于计费ID、计费类型、电路信息、接入类型、时间戳、上行流量，下行流量等。
S717：宽带接入路由器向AAA服务器发送计费开始报文。
应当理解的是，宽带接入路由器除了会发送计费开始报文以外，在统计流量的过程中间，也会定时向AAA服务器发送计费更新报文，在非双栈专线组用户下线或双栈专线组用户整体下线的时候向AAA服务器发送计费停止报文。
对于双栈专线组用户的下线流程，请参见图8示出的流程图：
S801：监测双栈专线用户触发的下线行为。
行为包含双栈专线用户发起的主动下线请求，如主动断电等行为；双栈专线用户授权回收，包含不限于AAA强制剔除该用户，授权时间超时，授权流量超出等。
S802：宽带接入路由器判断下线的双栈用户是否为双栈专线组的最后一个用户。
如果是执行S806；如果不是双栈专线组的最后一个用户，执行S803。
S803：宽带接入路由器删除对应通讯电路对应的子用户转发表。
双栈专线组用户中的某一个子用户下线，则该子用户对应的通讯电路上的用户转发行 为立即终止，宽带接入路由器累计子用户转发表中的流量信息。同时删除该电路对应的子用户转发表。
S804：宽带接入路由器删除对应通讯电路对应的子用户授权带宽信息。
S805：宽带接入路由器删除对应通讯电路对应的子用户会话表。
S806：宽带接入路由器删除组会话表。
S807：宽带接入路由器组装计费停止报文发送给AAA服务器。
实施例三：
本实施例提供一种可以实现前述群组化接入方案的通讯电路管理装置，请参见图9，该通讯电路管理装置90包括：
电路管理单元901，用于控制双栈专线用户使用的电路信息，与双栈专线接入单元902进行双向通讯。电路管理单元901接收双栈专线用户发出的接入访问请求，提取接入电路信息上报给双栈专线接入单元902，接收双栈专线接入单元902发送的电路状态消息，如电路开通消息，电路关闭消息，电路实施状态信息。电路管理单元901负责开通关闭转发管理单元908的数据业务流量。
电路管理单元901，用于控制双栈专线用户使用的电路信息。电路管理单元901接收双栈专线用户发出的接入访问请求，提取接入电路信息上报，并接受电路状态消息控制电路，如电路开通消息，电路关闭消息，电路实施状态信息。电路管理单元901负责数据业务流量转发的开通和关闭。
双栈专线接入单元902，用于控制双栈专线用户接入。双栈专线接入单元902接收并处理用户接入访问请求，提取接入电路信息，并根据宽带接入路由器的部署，生成双栈专线用户基础信息。双栈专线接入单元902负责在用户上线阶段，将双栈专线用户基础信息提供并发送，接收用户的统一授权信息。双栈专线接入单元902负责在用户在线阶段，实时查询用户电路接入状态，实时上报计费更新消息。双栈专线接入单元902负责在用户下线阶段，将双栈专线用户计费信息发送给相关AAA管理单元908。
组会话管理单元903，用于双栈专线业务群组化管理，是组会话标识的生成装置。组会话管理单元903负责与双栈专线接入单元902进行消息通讯，负责组用户标识的生成与删除；负责接收台账管理单元905发送的台账内容，负责将消息内容发送给双栈专线接入单元902；负责将统一授权信息发送给QOS管理单元906；负责与电路会话管理单元904进行消息互通，发送接收电路会话管理单元904需要的组信息及标识内容，包含MAC信息，电路信息，电路可用带宽等。
电路会话管理单元904，用于双栈专线业务群组化管理的电路会话管理部分，是电路会话标识生成的执行者。电路会话管理单元904负责获取需要的MAC信息，电路信息，电路可用带宽等，发送电路会话标识UserID，电路会话删除添加消息等。电路会话管理单元904负责将计费信息发送到台账管理单元905。
台账管理单元905，用于计费台账信息的管理及计算。台账管理单元905接收电路会话管理单元904发送的计费更新信息，计费停止信息，并进行计算，结果发送给组会话管理单元903。
QOS管理单元906，用于计算电路的QOS消息，对流量进行调度。QOS管理单元906负责计算电路合理使用带宽，将带宽放入不同的调度队列。QOS管理单元906负责将调度前后的流量发送给转发管理单元907。
转发管理单元907，用于宽带接入路由器的路由转发。转发管理单元907接收双栈专线接入单元902提供的路由消息。转发管理单元907接收电路会话管理单元904提供的MAC，电路等基本信息。
AAA管理单元908，用于与AAA服务器进行数据交互。AAA管理单元908用于解析组装AAA服务器的Radius报文信息。AAA管理单元908解析AAA服务器的信息内容， 如授权信息，并将消息内容发送给双栈专线接入单元902。AAA管理单元908接收双栈专线接入单元902发送的实时记账，离线记账信息，并组装为Radius报文发送给AAA服务器。
双栈专线接入单元902控制双栈专线用户接入，接收电路管理单元901发送的用户接入访问请求，提取接入电路信息，并根据宽带接入设备的部署，生成双栈专线用户基础信息。双栈专线接入单元902负责在用户上线阶段，将双栈专线用户基础信息提供给AAA管理单元908，接收AAA管理单元908返回的合法用户或非法用户消息结果，接收AAA管理单元908返回的企业用户统一授权信息，如限速。双栈专线接入单元902负责在用户在线阶段，实时向电路管理单元901查询用户电路接入状态，实时向AAA管理单元908上报计费更新消息。双栈专线接入单元902负责在用户下线阶段，将双栈专线用户计费信息发送给AAA管理单元908。双栈专线接入单元902负责为转发管理单元907提供数据转发需要的转发消息。双栈专线接入单元902，负责提供组会话管理903需要的组信息、限速信息、计费信息、MAC信息，电路信息，电路可用带宽等。
组会话管理903，用于双栈专线业务群组化管理，是组会话标识的生成装置。组会话管理903负责与双栈专线接入单元902进行消息通讯，负责组用户标识的生成与删除；负责接收台账管理单元905发送的台账内容，负责将消息内容发送给双栈专线接入单元902；负责将统一授权信息发送给QOS管理单元906；负责与电路会话管理904进行消息互通，发送接收电路会话管理需要的组信息及标识内容，包含MAC信息，电路信息，电路可用带宽等。
电路会话管理904，用于双栈专线业务群组化管理的电路会话管理部分，是电路会话标识的生成装置。电路会话管理904负责与组会话管理903进行消息通讯，获取需要的MAC信息，电路信息，电路可用带宽等，发送电路会话标识，电路会话删除添加消息等。电路会话管理904负责将计费信息发送到台账管理单元905。电路会话管理904负责将电路可用带宽等信息发送给QOS管理单元906。电路会话管理904负责将转发需要的MAC，电路基本信息等发送给转发管理单元907。
台账管理单元905，用于计费台账信息的管理及计算。台账管理单元905接收电路会话管理904发送的计费更新信息，计费停止信息，并进行计算，结果发送给组会话管理903。
QOS管理单元906，用于计算电路的QOS消息，对流量进行调度。QOS管理单元906，接收组会话管理903以及电路会话管理904发送的消息，计算电路合理使用带宽，将带宽放入不同的调度队列。QOS管理单元906负责将调度前后的流量发送给转发管理单元907。
转发管理单元907，用于宽带接入路由器的路由转发。转发管理单元907接收双栈专线接入单元902发送的路由消息。转发管理单元907接收电路会话管理904发送的mac，电路等基本信息。转发管理单元907接收发送QOS管理单元906的调度和队列信息。转发管理单元907将业务流量进行组装，投递给电路管理单元901进行转发。
AAA管理单元908，用户与AAA信息进行数据交互。AAA管理单元908用于解析组装运营商AAA系统的Radius报文信息。AAA管理单元908解析运营商AAA系统的信息内容，如授权信息，并将消息内容发送给双栈专线接入单元902。AAA管理单元908接收双栈专线接入单元902发送的实时记账，离线记账信息，并组装为Radius报文发送给AAA服务器。
在本实施例中，通讯电路管理装置90可以部署在宽带接入路由器等网络设备上，其中电路管理单元901、AAA管理单元908的功能可以通过网络设备的处理器与通信单元共同实现，双栈专线接入单元902、组会话管理单元903、电路会话管理单元904、台账管理单元905、QOS管理单元906以及转发管理单元907的功能可以通过网络设备的处理器实现。
实施例四：
本实施例提供一种存储介质，该存储介质中可以存储有一个或多个可供一个或多个处 理器读取、编译并执行的计算机程序，在本实施例中，该存储介质可以存储有通讯电路管理程序，该通讯电路管理程序可供一个或多个处理器执行实现前述实施例介绍的任意一种通讯电路管理方法的流程。
另外，本实施例提供一种网络设备，如图10所示：网络设备100包括处理器101、存储器102以及用于连接处理器101与存储器102的通信总线103，其中存储器102可以为前述存储有通讯电路管理程序的存储介质。处理器101可以读取通讯电路管理程序，进行编译并执行实现前述实施例中介绍的通讯电路管理方法的流程：
处理器101接收到某一接入点发起的上线请求后，根据上线请求向验证授权记账AAA服务器发送认证请求报文，随后，接收AAA服务器发送的表征认证通过的认证应答报文。若确定接入点属于某一组用户，且为组用户的首上线接入点，则处理器101创建组用户的组会话信息，开启组用户对应的通讯电路；组用户为在AAA服务器侧共用同一组标识信息的接入点的集合，首上线接入点为首个请求上线的接入点，然后处理器101基于组会话信息对组用户的通讯电路进行管理。
在本实施例的一些示例当中，组用户中的接入点为使用双协议栈技术的接入点。
在本实施例的一些示例当中，处理器101开启组用户对应的通讯电路时，可以为首上线接入点所对应的通讯电路建立子用户会话信息，开启首上线接入点所对应的通讯电路；
在本实施例的一些示例当中，处理器101开启组用户对应的通讯电路时，可以为组用户所对应的全部通讯电路均建立子用户会话信息，并开启组用户所对应的全部通讯电路。
处理器101为首上线接入点所对应的通讯电路建立子用户会话信息之后，基于组会话信息对组用户的通讯电路进行管理时，可以接收某一接入点发起的上线请求，若确定接入点为组用户的非首上线接入点，则为接入点所对应的通讯电路建立子用户会话信息，开启非首上线接入点所对应的通讯电路，非首上线接入点为组用户中非首个请求上线的接入点。
处理器101基于组会话信息对组用户的通讯电路进行管理时，可以接收组用户中任意一个接入点发起的下线请求；若当前发起下线请求的接入点并非组用户的末下线接入点，则关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息，末下线接入点为组用户中最后一个下线的接入点。
处理器101接收组用户中任意一个接入点发起的下线请求之后，若当前发起下线请求的接入点是组用户的末下线接入点，则关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息，删除组会话信息；并将累计的组用户的计费信息携带在计费停止报文中发送给AAA服务器。
在本实施例的另外一些示例当中，处理器101接收组用户中任意一个接入点发起的下线请求之后，可以先不经判断直接关闭该接入点的通讯电路，累计组用户中所有已下线的接入点的计费信息。然后再判断接入点是否是组用户的末下线接入点，若是，则删除组会话信息，并将累计的组用户的计费信息携带在计费停止报文中发送给AAA服务器。
在本实施例的一些示例当中，处理器101还会根据组会话信息确定AAA服务器为组用户统一授权的组授权带宽，并确定组用户所对应的各通讯电路的最大可承载带宽，然后根据组授权带宽与各通讯电路的最大可承载带宽确定各通讯电路所对应的电路授权带宽，并按照各通讯电路的电路授权带宽控制各通讯电路的数据流量。
在本实施例的一些示例当中，处理器可以根据各通讯电路的最大可承载带宽之间的比值划分组限速值得到各通讯电路所对应的电路授权带宽。
在一实施例中，处理器确定接入点属于某一组用户时，可以根据本地预先存储的组用户与各通讯电路之间的映射关系确定接入点属于某一组用户；也可以根据AAA服务器认证应答报文确定接入点属于某一组用户，AAA服务器侧存储有组用户与各通讯电路之间的映射关系。
本实施例提供的网络设备，在接收到某一接入点发起的上线请求后，根据上线请求向 验证授权记账AAA服务器发送认证请求报文；在根据AAA服务器发送的认证应答表文确定认证通过后，确定接入点属于某一组用户，且为组用户的首上线接入点，则创建组用户的组会话信息，开启组用户对应的通讯电路，基于组会话信息对组用户的通讯电路进行管理。在本申请实施例中，提出了“组用户”的概念对属于同一拥有者(例如企业)的所有通讯电路进行统一管理，这样属于同一拥有者的各通讯电路所对应的接入点在使用不同的网络登录账号时，可以共享同一个“套餐”，无论是对于网络侧的AAA服务器，还是对于通讯电路的拥有者，均可在不改变现有使用习惯、运维系统、运维习惯的基础上，扩展兼容后续IPV6、双栈网络切换带来的多地址、多接入点的管理情景，在管理维护通讯电路的过程都更方便，有利于降低网络侧、设备侧的管理负担，提升用户体验。
本申请实施例提供的通讯电路管理方法、网络设备及存储介质，在接收到某一接入点发起的上线请求后，根据上线请求向验证授权记账AAA服务器发送认证请求报文；在根据AAA服务器发送的认证应答表文确定认证通过后，确定接入点属于某一组用户，且为组用户的首上线接入点，则创建组用户的组会话信息，开启组用户对应的通讯电路，基于组会话信息对组用户的通讯电路进行管理。在本申请实施例中，提出了“组用户”的概念对属于同一拥有者(例如企业)的所有通讯电路进行统一管理，这样属于同一拥有者的各通讯电路所对应的接入点在使用不同的网络登录账号时，可以共享同一个“套餐”，无论是对于网络侧的AAA服务器，还是对于通讯电路的拥有者，均可在不改变现有使用习惯、运维系统、运维习惯的基础上，扩展兼容后续IPV6、双栈网络切换带来的多地址、多接入点的管理情景，在管理维护通讯电路的过程都更方便，有利于降低网络侧、设备侧的管理负担，提升用户体验。
显然，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM,ROM,EEPROM、闪存或其他存储器技术、CD-ROM，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本申请不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本申请实施例所作的进一步详细说明，不能认定本申请的具体实施只局限于这些说明。对于本申请所属技术领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本申请的保护范围。

Claims (12)

  1. 一种通讯电路管理方法，包括：
    接收到某一接入点发起的上线请求后，根据所述上线请求向验证授权记账AAA服务器发送认证请求报文；
    接收所述AAA服务器发送的表征认证通过的认证应答报文；
    若确定所述接入点属于某一组用户，且为所述组用户的首上线接入点，则创建所述组用户的组会话信息，开启所述组用户对应的通讯电路；所述组用户为在所述AAA服务器侧共用组标识信息的各接入点的集合，所述首上线接入点为首个请求上线的接入点；
    基于所述组会话信息对所述组用户的通讯电路进行管理。
  2. 如权利要求1所述的通讯电路管理方法，其中，所述开启所述组用户对应的通讯电路包括：
    为所述首上线接入点所对应的通讯电路建立子用户会话信息，开启所述首上线接入点所对应的通讯电路；
    或，
    为所述组用户所对应的全部通讯电路均建立子用户会话信息，并开启所述组用户所对应的全部通讯电路。
  3. 如权利要求2所述的通讯电路管理方法，其中，所述为所述首上线接入点所对应的通讯电路建立子用户会话信息之后，基于所述组会话信息对所述组用户的通讯电路进行管理包括：
    接收某一接入点发起的上线请求；
    确定所述接入点为所述组用户的非首上线接入点，所述非首上线接入点为所述组用户中非首个请求上线的接入点；
    为所述接入点所对应的通讯电路建立子用户会话信息，开启所述非首上线接入点所对应的通讯电路。
  4. 如权利要求1所述的通讯电路管理方法，其中，所述基于所述组会话信息对所述组用户的通讯电路进行管理包括：
    当接收到所述组用户中任意一个接入点发起的下线请求时，关闭该接入点的通讯电路，累计所述组用户中所有已下线的接入点的计费信息，所述末下线接入点为所述组用户中最后一个下线的接入点；
    在当前发起下线请求的接入点是所述组用户的末下线接入点时，删除所述组会话信息，并将累计的所述组用户的计费信息携带在计费停止报文中发送给所述AAA服务器。
  5. 如权利要求4所述的通讯电路管理方法，其中，在关闭该接入点的通讯电路，累计所述组用户中所有已下线的接入点的计费信息之前，还包括：
    判断所述接入点是否是所述组用户的末下线接入点，若是，则关闭该接入点的通讯电路，累计所述组用户中所有已下线的接入点的计费信息，删除所述组会话信息，并将累计的所述组用户的计费信息携带在计费停止报文中发送给所述AAA服务器。
  6. 如权利要求4所述的通讯电路管理方法，其中，在关闭该接入点的通讯电路，累计所述组用户中所有已下线的接入点的计费信息之后，还包括：
    判断所述接入点是否是所述组用户的末下线接入点，若是，则删除所述组会话信息，并将累计的所述组用户的计费信息携带在计费停止报文中发送给所述AAA服务器。
  7. 如权利要求1所述的通讯电路管理方法，其中，所述基于所述组会话信息对所述组用户的通讯电路进行管理还包括：
    根据所述组会话信息确定所述AAA服务器为所述组用户统一授权的组授权带宽，并 确定所述组用户所对应的各通讯电路的最大可承载带宽；
    根据所述组授权带宽与各通讯电路的最大可承载带宽确定各所述通讯电路所对应的电路授权带宽；
    按照各所述通讯电路的电路授权带宽控制各所述通讯电路的数据流量。
  8. 如权利要求7所述的通讯电路管理方法，其中，所述根据所述组授权带宽与各通讯电路的最大可承载带宽确定各所述通讯电路所对应的电路授权带宽包括：
    根据各所述通讯电路的最大可承载带宽之间的比值划分所述组限速值得到各所述通讯电路所对应的电路授权带宽。
  9. 如权利要求1-8任一项所述的通讯电路管理方法，其中，所述确定所述接入点属于某一组用户包括：
    根据本地预先存储的组用户与各通讯电路之间的映射关系确定所述接入点属于某一组用户；
    或，
    根据所述AAA服务器所述认证应答报文确定所述接入点属于某一组用户，所述AAA服务器侧存储有组用户与各通讯电路之间的映射关系。
  10. 如权利要求1-8任一项所述的通讯电路管理方法，其中，所述组用户中的接入点为使用双协议栈技术的接入点。
  11. 一种网络设备，所述网络设备包括处理器、存储器及通信总线；
    所述通信总线用于实现处理器和存储器之间的连接通信；
    所述处理器用于执行存储器中存储的一个或者多个程序，以实现如权利要求1至10中任一项所述的通讯电路管理方法的步骤。
  12. 一种存储介质，其中，所述存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如权利要求1至10中任一项所述的通讯电路管理方法的步骤。
PCT/CN2020/112621 2019-10-11 2020-08-31 一种通讯电路管理方法、网络设备及存储介质 WO2021068685A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910964911.9A CN112653653B (zh) 2019-10-11 2019-10-11 一种通讯电路管理方法、网络设备及存储介质
CN201910964911.9 2019-10-11

Publications (1)

Publication Number Publication Date
WO2021068685A1 true WO2021068685A1 (zh) 2021-04-15

Family

ID=75343519

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/112621 WO2021068685A1 (zh) 2019-10-11 2020-08-31 一种通讯电路管理方法、网络设备及存储介质

Country Status (2)

Country Link
CN (1) CN112653653B (zh)
WO (1) WO2021068685A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104426686A (zh) * 2013-08-22 2015-03-18 中国电信股份有限公司 宽带接入网关用户接入方法、装置及宽带接入网关
CN105337819A (zh) * 2014-08-15 2016-02-17 中国电信股份有限公司 宽带接入网关的数据处理方法、宽带接入网关及网络系统
WO2016095391A1 (zh) * 2014-12-18 2016-06-23 中兴通讯股份有限公司 带宽资源的调整方法、服务端及调整设备
CN106254447A (zh) * 2016-07-29 2016-12-21 北京华为数字技术有限公司 负载均衡方法、bras设备和sdn控制器
CN109768906A (zh) * 2019-03-29 2019-05-17 新华三技术有限公司 一种子网专线配置方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1310476C (zh) * 2004-07-05 2007-04-11 华为技术有限公司 无线局域网用户建立会话连接的方法
CN102404293A (zh) * 2010-09-15 2012-04-04 中兴通讯股份有限公司 一种双栈用户管理方法及宽带接入服务器
CN102238547B (zh) * 2011-07-19 2013-12-04 华为软件技术有限公司 控制用户会话的方法、会话服务器、aaa服务器和系统
CN103546286B (zh) * 2012-07-13 2018-08-24 中兴通讯股份有限公司 认证处理方法及装置
EP2981108A4 (en) * 2013-05-15 2016-04-13 Huawei Tech Co Ltd BILLING LOADING METHOD, GATEWAY DEVICE, BILLING DEVICE AND COMMUNICATION SYSTEM
CN106331197A (zh) * 2015-06-29 2017-01-11 中兴通讯股份有限公司 管理专线用户的方法、宽带接入服务器及管理服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104426686A (zh) * 2013-08-22 2015-03-18 中国电信股份有限公司 宽带接入网关用户接入方法、装置及宽带接入网关
CN105337819A (zh) * 2014-08-15 2016-02-17 中国电信股份有限公司 宽带接入网关的数据处理方法、宽带接入网关及网络系统
WO2016095391A1 (zh) * 2014-12-18 2016-06-23 中兴通讯股份有限公司 带宽资源的调整方法、服务端及调整设备
CN106254447A (zh) * 2016-07-29 2016-12-21 北京华为数字技术有限公司 负载均衡方法、bras设备和sdn控制器
CN109768906A (zh) * 2019-03-29 2019-05-17 新华三技术有限公司 一种子网专线配置方法及装置

Also Published As

Publication number Publication date
CN112653653B (zh) 2023-08-22
CN112653653A (zh) 2021-04-13

Similar Documents

Publication Publication Date Title
CN105765921B (zh) 用于利用软件定义网络功能进行diameter路由的方法、系统和设备
US10972437B2 (en) Applications and integrated firewall design in an adaptive private network (APN)
US8059533B2 (en) Packet flow optimization (PFO) policy management in a communications network by rule name
US8542592B2 (en) Managing a network flow using application classification information and active signaling relay
US8203943B2 (en) Colored access control lists for multicast forwarding using layer 2 control protocol
US8160068B2 (en) System and method for facilitating communication between a CMTS and an application server in a cable network
US8675488B1 (en) Subscriber-based network traffic management
US10135942B2 (en) Differentiated priority level communication
US20040223497A1 (en) Communications network with converged services
US20010044893A1 (en) Distributed subscriber management system
JP2001308935A (ja) 通信システム、通信方法及び通信装置
WO2004105319A1 (fr) Procede d'acces a large bande et grande capacite et systeme associe
WO2009132548A1 (zh) 策略决策功能实体、家庭网关、服务质量控制方法及系统
US20050147035A1 (en) Multiple services with policy enforcement over a common network
EP2966899B1 (en) Hqos control method, rsg, and hqos control system
EP2909993B1 (en) Method and system for handling subscribers' network traffic
Gommans et al. Token-based authorization of connection oriented network resources
US20040153556A1 (en) Connections on demand between subscribers and service providers
Mitton et al. Network access server requirements next generation (nasreqng) nas model
US7698384B2 (en) Information collecting system for providing connection information to an application in an IP network
US9277014B2 (en) Handling of auxiliary NAS
CN101155055A (zh) 一种下一代网络的用户管理方法和系统
WO2021068685A1 (zh) 一种通讯电路管理方法、网络设备及存储介质
WO2020029793A1 (zh) 一种上网行为管理系统、设备及方法
CN100477609C (zh) 实现网络专线接入的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20875175

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20875175

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 20875175

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 27/09/2022)