WO2022057758A1

WO2022057758A1 - Session resource control method and apparatus, device, system, and storage medium

Info

Publication number: WO2022057758A1
Application number: PCT/CN2021/117944
Authority: WO
Inventors: 李莉; 谢光华; 陈华南; 朱永庆
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-09-17
Filing date: 2021-09-13
Publication date: 2022-03-24
Also published as: CN111835615A; CN111835615B

Abstract

The embodiments of the present application provide a session resource control method and apparatus, a device, a system, and a storage medium. Said method comprises: after a client establishes a session with a virtual private dial-up network (VPDN) virtual private network server by means of a VPDN access device, monitoring whether the session is anomalous; and if the session is detected to be anomalous, releasing resources occupied by the session on the VPDN access device.

Description

Session resource control method, apparatus, device, system and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of Chinese patent application CN202010977724.7, which was filed on September 17, 2020 and is entitled "Session resource control method, device, device, system and storage medium", the entire contents of which are incorporated into this application by reference. .

technical field

The embodiments of the present application relate to the field of communications, and in particular, to a method, apparatus, device, system, and storage medium for controlling session resources.

Background technique

VPDN (Virtual Private Dia-up Network, Virtual Private Dial-Up Network) refers to the dial-up function using a public network (such as ISDN (Integrated Services Digital Network, Integrated Services Digital Network)) or PSTN (Public Switched Telephone Network, Public Switched Telephone Network)) Access the public network to realize virtual private network, so as to provide access services for enterprises, small ISPs (Internet Service Providers, Internet Service Providers), mobile office workers, etc. VPDN provides an economical and effective point-to-point connection between remote users and private enterprise networks.

VPDN uses a dedicated network communication protocol to establish a secure virtual private network for enterprises on the public network. The company's overseas offices and business travelers can remotely connect to the corporate headquarters through a virtual tunnel through the public network, while other users on the public network cannot access through the virtual tunnel.

In the VPDN system of the related art, a client communicates with a VPDN virtual private network server by establishing a session through a VPDN access device. However, in the current session mechanism, when a session is abnormal, the VPDN access device in the related art cannot perceive the abnormality of the session, so that the session resources on the VPDN access device cannot be released and are occupied for a long time, which also affects new The establishment of the session leads to waste of resources.

SUMMARY OF THE INVENTION

A session resource control method, apparatus, device, system, and storage medium provided by the embodiments of the present application are intended to solve the problem in the related art that when the session between the client and the VPDN virtual private network server is abnormal, the session occupied by the VPDN access device The resource cannot be released and is occupied for a long time, which affects the establishment of a new session and leads to a waste of resources.

To solve the above technical problem, an embodiment of the present application provides a method for controlling session resources, including: after a client establishes a session with a VPDN virtual private network server through a virtual private dial-up network VPDN access device, monitoring whether the session is abnormal; When the session is abnormal, the resources occupied by the session on the VPDN access device are released.

In order to solve the above technical problem, the embodiment of the present application also provides a session resource control device, including: a monitoring module, used for monitoring after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device. Whether the session is abnormal; a control module, configured to release the resources occupied by the session on the VPDN access device when the monitoring module detects that the session is abnormal.

In order to solve the above technical problem, the embodiment of the present application also provides a VPDN access device, including a processor, a communication bus and a memory, the communication bus is used to connect the processor and the memory, and the memory stores A computer program, where the processor is configured to invoke and execute the computer program to implement the steps of the method for controlling session resources as described above.

In order to solve the above technical problem, the embodiment of the present application also provides a VPDN system, including a VPDN access device, a VPDN virtual private network server, and a client; the VPDN access device is used to pass the VPDN at the client After the access device establishes a session with the VPDN virtual private network server, it monitors whether the session is abnormal, and when the session is abnormal, releases the resources occupied by the session on the VPDN access device.

To solve the above technical problems, embodiments of the present application further provide a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and the computer program can be executed by a processor to implement the above-mentioned conversation Steps of a resource control method.

Other features and corresponding beneficial effects of the present application are described in later parts of the specification, and it should be understood that at least some of the beneficial effects will become apparent from the description in the specification of the present application.

Description of drawings

FIG. 1 is a schematic flowchart of a method for controlling session resources provided in Embodiment 1 of the present application;

FIG. 2 is a schematic diagram 1 of L2TP/VPN networking according to Embodiment 1 of the present application;

FIG. 3 is a second schematic diagram of L2TP/VPN networking according to Embodiment 1 of the present application;

FIG. 4 is a schematic structural diagram of a session resource control apparatus according to Embodiment 2 of the present application;

5 is a schematic structural diagram of a VPDN access device provided in Embodiment 2 of the present application;

6 is a schematic structural diagram of a VPDN system provided in Embodiment 2 of the present application;

7 is a schematic flowchart of a client establishing a session with a VPDN virtual private network server through a VPDN access device according to Embodiment 2 of the present application;

FIG. 8 is a schematic flowchart of a method for controlling session resources according to Embodiment 2 of the present application.

detailed description

In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the embodiments of the present application will be described in further detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

Example 1

The specific embodiments of the present application will be described in further detail below with reference to the accompanying drawings and implementation examples.

In the related art, when the session between the client and the VPDN virtual private network server is abnormal, the resources occupied by the session on the VPDN access device cannot be released and are occupied for a long time, which affects the establishment of a new session and leads to a waste of resources. The session resource control method provided in this embodiment can release the session occupied on the VPDN access device when the client detects that the session is abnormal after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device. It can prevent the resources occupied by the session on the VPDN access device from being occupied for a long time ineffective, improve resource utilization, avoid affecting the establishment of new sessions, and also improve the overall performance of the VPDN system, thereby improving user experience satisfaction. For ease of understanding, the method for controlling session resources provided by this embodiment is described below with reference to FIG. 1 as an example. Referring to FIG. 1 , the method includes but is not limited to the following steps.

S101: After the client establishes a session with a VPDN virtual private network (Virtual Private Network, VPN) server through the VPDN access device, monitor whether the session is abnormal.

It should be understood that the client in the VPDN system in this embodiment may be various communication terminals capable of establishing a VPDN session with the VPDN virtual private network server, and the type of the client is not limited in this embodiment.

It should be understood that, in this embodiment, the manner in which the client establishes a session with the VPDN virtual private network server through the VPDN access device can be flexibly set according to specific application scenarios. For example, in some application scenarios, the VPDN tunneling protocol can adopt but is not limited to the following three protocols: ①PPTP (Point-to-Point Tunneling Protocol, point-to-point tunneling protocol); ②L2F (Layer 2 Forwarding, Layer 2 forwarding); ③L2TP (Layer 2 Tunneling Protocol, Layer 2 Tunneling Protocol).

For ease of understanding, the following uses L2TP as an example for description. L2TP is a type of VPDN (Virtual Private Dial-up Network) tunneling protocol. It was jointly formulated by Cisco, Microsoft and other companies in 1999. Manufacturer's support is currently the most widely used.

An exemplary L2TP/VPN networking schematic diagram is shown in Figures 2 and 3. It can be seen from the figures that the three elements of L2TP/VPN networking include LNS (L2TP Network Server, Layer 2 Tunneling Protocol Virtual Private Network Server) 203, LAC (L2TP Access Concentrator, Layer 2 Tunneling Protocol Access Device) 202 and client Client 201.

Among them, the Layer 2 tunneling protocol virtual private network server LNS 203: L2TP Network Server is the VPN server on the L2TP enterprise side. In some examples, the LNS may complete the final authorization and authentication of the user, receive tunnel and connection requests from the LAC, and establish a PPP (Point to Point Protocol) channel connecting the LNS and the user.

Layer 2 tunneling protocol access device LAC 202: L2TP Access Concentrator, which is an L2TP access device. Provides AAA (Authentication, Authorization, Accounting, authentication, authorization, accounting) services for various user access, the function of initiating tunnel and session connections, and the proxy authentication function for VPN users. The LAC is an access device that provides VPN services on the ISP side. In terms of physical implementation, the LAC can be, but not limited to, a router or access server configured with L2TP, or a dedicated VPN server.

Client: Dial-up client 201.

In related technologies, most of the session keep-alive technologies are between the client and the LNS device, and the session keep-alive technology is not used between the client and the LAC, so that the LAC cannot perceive the abnormality of the session, which in turn causes the session to be stored in the LAC. The resources occupied by the previous session cannot be released in time when the session is abnormal, which affects the establishment of a new session and leads to a waste of resources.

In the L2TP scenario, the LNS corresponds to the VPDN virtual private network server in the VPDN network system, and the LAC corresponds to the VPDN access device in the VPDN network system. Correspondingly, there are servers and devices corresponding to the VPDN virtual private network server and the VPDN access device in the PPTP and the L2F respectively, which will not be repeated here.

S102: When detecting that the session is abnormal, release the resources occupied by the session on the VPDN access device.

It should be understood that, in some application instances of this embodiment, all resources occupied by the session on the VPDN access device may be released, and some resources occupied by the session on the VPDN access device may also be released according to requirements. Flexible settings according to needs.

It should be understood that, in this embodiment, the manner of monitoring whether the session established between the client and the VPDN virtual private network server is abnormal can be flexibly adopted.

In one embodiment, the working state of at least one of the client, the VPDN virtual private network server, and the VPDN access device can be monitored. When an abnormal working state of a certain device is detected, it is likely to cause the client The session established with the VPDN virtual private network server is abnormal.

For another example, in another implementation manner, it can be monitored whether the packets exchanged between the client and the VPDN virtual private network server are abnormal, and if so, it can be determined that the session is abnormal. In this embodiment, at least one of the following packets but not limited to the following packets between the client and the VPDN virtual private network server may be monitored: LCP (Link) between the client and the VPDN virtual private network server Control Protocol) link establishment message; LCP authentication message between client and VPDN virtual private network server; NCP (Network Control Protocol, Network Control Protocol) negotiation between client and VPDN virtual private network server packets; keep-alive interaction packets between the client and the VPDN virtual private network server; access enterprise data interaction packets between the client and the VPDN virtual private network server.

It should be understood that, in this embodiment, the method of monitoring whether the packets exchanged between the client and the VPDN virtual private network server are abnormal can also be flexibly set. For example, in an application scenario, any of the following two methods can be used: A sort of.

Method 1: Monitor whether the VPDN access device receives the corresponding message, if not, determine that the message exchanged between the client and the VPDN virtual private network server is abnormal.

For example, in one embodiment, it can monitor whether the VPDN access device receives the LCP link establishment message between the client and the VPDN virtual private network server, if not, it can be considered that the client and the VPDN virtual private network server are connected The packets exchanged between them are abnormal.

For another example, in one embodiment, it can be monitored whether the VPDN access device receives the LCP authentication message between the client and the VPDN virtual private network server, if not, it can be considered that the client and the VPDN virtual private network server The packets exchanged between them are abnormal.

For another example, in one embodiment, it can be monitored whether the VPDN access device receives the NCP negotiation message between the client and the VPDN virtual private network server. The packets exchanged between them are abnormal.

For another example, in one embodiment, it can be monitored whether the VPDN access device receives a keep-alive interaction message between the client and the VPDN virtual private network server, if not, it can be considered that the client and the VPDN virtual private network server are The packets exchanged between them are abnormal.

For another example, in one embodiment, it may be monitored whether the VPDN access device receives the client's access enterprise data exchange message, if not, it may be considered that the message exchanged between the client and the VPDN virtual private network server is abnormal.

That is, in this mode, it can be monitored whether the VPDN access device normally receives at least LCP link establishment packets, LCP authentication packets, NCP negotiation packets, keep-alive interaction packets, and access enterprise data interaction packets. One, and it can be determined that any one or two of them cannot be received normally, it can be considered that the packets exchanged between the client and the VPDN virtual private network server are abnormal.

Method 2: Monitor whether the flow of packets exchanged between the client and the VPDN virtual private network server is abnormal. If so, determine whether the packets exchanged between the client and the VPDN virtual private network server are abnormal.

In this mode, the packets between the client and the VPDN virtual private network server can be set as the forwarding traffic of the VPDN access device for the VPDN access device, and the forwarding traffic can be used as the VPDN access device to determine the client and the VPDN virtual private network. The basis for whether the session between servers is still normal. For example, in one embodiment, monitoring whether the traffic of packets exchanged between the client and the VPDN virtual private network server is abnormal may include, but is not limited to, monitoring the client and the VPDN virtual private network server within a preset monitoring period. Whether the traffic of the packets exchanged between them has changed, if not, it is determined that the traffic of the packets exchanged between the client and the VPDN virtual private network server is abnormal.

In this mode, LCP link establishment packets, LCP authentication packets, NCP negotiation packets, keep-alive interaction packets, and access enterprise data interaction packets between the client and the VPDN virtual private network server can all be used as VPDN connection packets. The forwarding traffic of the incoming device, or only a part of the LCP link establishment packets, LCP authentication packets, NCP negotiation packets, keep-alive interaction packets, and access enterprise data interaction packets can be used as the forwarding traffic of the VPDN access device. For example, only keep-alive interaction packets and access enterprise data interaction packets may be used as the forwarding traffic of the VPDN access device.

It can be seen that the session resource control method provided by this embodiment can flexibly and accurately monitor whether the session is abnormal in various ways after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device. And when the abnormality of the session is detected, the resources occupied by the session on the VPDN access device can be released in time, so as to prevent the resources occupied by the session on the VPDN access device from being occupied for a long time ineffective, improve resource utilization, and avoid affecting new sessions. The establishment of the VPDN system can also improve the overall performance of the VPDN system and the satisfaction of the user experience.

Embodiment 2

In order to facilitate understanding, this embodiment further provides a session resource control apparatus based on the above-mentioned embodiment, and the session resource control apparatus can be set in the VPDN access device or in other network element devices. See FIG. 4, it includes but is not limited to the following modules.

The monitoring module 401 is configured to monitor whether the session is abnormal after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device; This will not be repeated here.

The control module 402 is configured to release the resources occupied by the session on the VPDN access device when the monitoring module detects that the session is abnormal. An example processing procedure can be referred to but not limited to that shown in the foregoing embodiment, and details are not described herein again.

It should be understood that, in some examples of this embodiment, the functions of the monitoring module 401 and the control module 402 may be implemented by but not limited to a processor.

This embodiment also provides a VPDN access device, as shown in FIG. 5 , which includes but is not limited to a processor 501, a communication bus 502, and a memory 503. The communication bus 502 is used to connect the processor 501 and the memory 503, and the memory A computer program is stored in 503, and the processor is used to invoke and execute the computer program to implement the steps of the session resource control method shown in the above embodiment.

This embodiment also provides a VPDN system, as shown in FIG. 6 , which includes but is not limited to: a VPDN access device 602 , a VPDN virtual private network server 603 and a client 601 .

The VPDN access device 602 is used to monitor whether the session is abnormal after the client 601 establishes a session with the VPDN virtual private network server through the VPDN access device 602 itself, and releases the session occupation on the VPDN access device when the session is abnormal resource of. One example of the monitoring and the process of releasing resources occupied by a session can be referred to, but not limited to, those shown in the foregoing embodiments, and details are not described herein again.

For ease of understanding, this embodiment uses the L2TP/VPN networking application scenario shown in FIG. 2 as an example to illustrate the method for controlling session resources. Referring to Fig. 7, the process of establishing a session between the client and the VPDN virtual private network server through the VPDN access device includes but is not limited to the following steps.

S701: The client uses the PPPOE protocol to dial up and negotiate with the device where the LAC is located in the discovery phase.

S702: The client and the LAC device perform LCP negotiation and authentication.

S703: The LAC device is successfully authenticated and found to be an L2TP user (ie, an L2TP client), and negotiates an L2TP tunnel and a session.

S704: The negotiation is successful and the LAC user goes online successfully, and the LAC starts the session keep-alive.

S705: The client and the LNS device perform LCP chain establishment and authentication.

S706: The client and the LNS device perform NCP negotiation.

S707: Session keep-alive interaction is performed between the client and the LNS device.

S708: The client accesses enterprise data.

S709: The LAC device is configured and session exception monitoring is started.

In an implementation manner, the process of configuring the LAC device and starting session exception monitoring is shown in FIG. 8 , which includes but is not limited to the following steps.

S801: Periodically capture the packet traffic between the client and the LNS.

In this example, after the LAC device is configured and starts session exception monitoring, it regularly monitors any traffic generated by the interaction between the client and the LNS in the above-mentioned steps S705 to S708, including but not limited to the LCP between the client and the LNS device. Link establishment packets, LCP authentication packets, NCP negotiation packets, keep-alive interaction packets, and access enterprise data interaction packets are all used by the LAC device to determine whether the session between the client and the LNS device is normal. The LAC device regularly obtains the traffic of packets between the client and the LNS device. If the traffic does not change within the configured monitoring period, it determines that the session between the client and the LNS device has expired, and the LAC device actively releases the expired session. resources occupied. It should be understood that in this example, the monitoring period can be set flexibly, and it can also be set according to requirements when the traffic does not change in consecutive N (N is greater than or equal to 2) monitoring periods, and the session between the client and the LNS device is determined. has expired.

S802: Determine whether the flow rate changes during the monitoring period, if so, go to S801; otherwise, go to S803.

S803: Whether the monitoring period is exceeded, if yes, go to S804; otherwise, go to S801.

S804: The LAC device actively releases the resources occupied by the invalid session.

It can be seen that in the application scenario shown in this embodiment, after the client establishes a session with the LNS device through the LAC device itself, the LAC device can use various methods to flexibly and accurately monitor whether the session is abnormal, and when monitoring the session When the session is abnormal, it can actively release the resources occupied by the session in time to avoid the resources occupied by the session on the LAC device being occupied for a long time and ineffective, and improve the resource utilization rate.

Embodiment 3

This embodiment also provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and the computer program can be executed by a processor to implement the steps in the session resource control method shown in the above embodiments.

The computer-readable storage medium in this embodiment may be provided on, but not limited to, a base station, for example, a BBU of the base station, which is included in the storage medium for storing information (such as computer-readable instructions, data structures, computer program modules or other data), volatile or nonvolatile, removable or non-removable media implemented in any method or technology. Computer-readable storage media include but are not limited to RAM (Random Access Memory, random access memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, electrically erasable programmable read-only memory) , Flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), Digital Versatile Disc (DVD) or other optical disk storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or Any other medium that can be used to store the desired information and that can be accessed by a computer.

This embodiment also provides a computer program (or computer software), which can be distributed on a computer-readable medium and executed by a computer-readable device, so as to implement the steps in the above-mentioned session resource control method; And in some cases, at least one of the steps shown or described may be performed in an order different from that described in the above embodiments.

This embodiment also provides a computer program product, including a computer-readable device, on which any of the computer programs shown above are stored. In this embodiment, the computer-readable device may include the computer-readable storage medium as described above.

In the session resource control method, device, device, system and storage medium provided by the embodiments of the present application, after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device, monitor whether the session is abnormal; When an abnormality of the session is detected, the resources occupied by the session on the VPDN access device are released, so as to prevent the resources occupied by the session from being occupied for a long time ineffectively, improve resource utilization, avoid affecting the establishment of new sessions, and also improve the performance of the VPDN system. Comprehensive performance, thereby improving user experience satisfaction.

It can be seen that those skilled in the art should understand that all or some of the steps in the methods disclosed above, the functional modules/units in the system, and the device can be implemented as software (which can be implemented by computer program codes executable by a computing device). ), firmware, hardware, and their appropriate combination. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .

In addition, communication media typically embodies computer readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery, as is well known to those of ordinary skill in the art medium. Therefore, the present application is not limited to any particular combination of hardware and software.

The above content is a further detailed description of the embodiments of the present application in conjunction with specific implementations, and it cannot be considered that the specific implementation of the present application is limited to these descriptions. For those of ordinary skill in the technical field of the present application, without departing from the concept of the present application, some simple deductions or substitutions can be made, which should be regarded as belonging to the protection scope of the present application.

Claims

A session resource control method, comprising:

After the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device, monitor whether the session is abnormal;

When the abnormality of the session is detected, the resources occupied by the session on the VPDN access device are released.
The session resource control method according to claim 1, wherein the monitoring whether the session is abnormal comprises:

When it is detected that the packets exchanged between the client and the VPDN virtual private network server are abnormal, it is determined that the session is abnormal.
The session resource control method according to claim 2, wherein the message includes at least one of the following messages:

link control protocol LCP link establishment message between the client and the VPDN virtual private network server;

LCP authentication message between the client and the VPDN virtual private network server;

a network control protocol NCP negotiation message between the client and the VPDN virtual private network server;

keep-alive interaction messages between the client and the VPDN virtual private network server;

The access enterprise data exchange message between the client and the VPDN virtual private network server.
The session resource control method according to claim 2 or 3, wherein monitoring whether the packets exchanged between the client and the VPDN virtual private network server are abnormal comprises:

Monitor whether the VPDN access device receives the message, and if not, determine that the message exchanged between the client and the VPDN virtual private network server is abnormal;

or,

Monitoring whether the flow of packets exchanged between the client and the VPDN virtual private network server is abnormal, if so, determining that the packets exchanged between the client and the VPDN virtual private network server are abnormal.
The session resource control method according to claim 4, wherein the monitoring whether the flow of packets exchanged between the client and the VPDN virtual private network server is abnormal comprises:

Within a preset monitoring period, monitor whether the flow of packets exchanged between the client and the VPDN virtual private network server changes, and if not, determine the relationship between the client and the VPDN virtual private network server The traffic of the exchanged packets is abnormal.
The session resource control method according to any one of claims 1-3, wherein the VPDN access device is a Layer 2 tunneling protocol access device, and the VPDN virtual private network server is a Layer 2 tunneling protocol virtual private network server.
A session resource control device, comprising:

a monitoring module, configured to monitor whether the session is abnormal after the client establishes a session with the VPDN virtual private network server through the virtual private dial-up network VPDN access device;

A control module, configured to release the resources occupied by the session on the VPDN access device when the monitoring module detects that the session is abnormal.
A VPDN access device, comprising a processor, a communication bus and a memory, the communication bus is used to connect the processor and the memory, the memory stores a computer program, and the processor is used to call and execute the The computer program is used to implement the steps of the session resource control method according to any one of claims 1-6.
A VPDN system, including a VPDN access device, a VPDN virtual private network server and a client;

The VPDN access device is configured to monitor whether the session is abnormal after the client establishes a session with the VPDN virtual private network server through the VPDN access device, and release the session when the session is abnormal. resources occupied by the session on the VPDN access device.
A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program can be executed by a processor to implement the session resource control method according to any one of claims 1-6 A step of.