WO2023011233A1 - 流量管理方法、装置、设备及计算机可读存储介质 - Google Patents

流量管理方法、装置、设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2023011233A1
WO2023011233A1 PCT/CN2022/107616 CN2022107616W WO2023011233A1 WO 2023011233 A1 WO2023011233 A1 WO 2023011233A1 CN 2022107616 W CN2022107616 W CN 2022107616W WO 2023011233 A1 WO2023011233 A1 WO 2023011233A1
Authority
WO
WIPO (PCT)
Prior art keywords
policy
user
authentication
traffic
module
Prior art date
Application number
PCT/CN2022/107616
Other languages
English (en)
French (fr)
Inventor
余舟毅
冯力刚
董继生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023011233A1 publication Critical patent/WO2023011233A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/10—Flow control between communication endpoints
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing

Definitions

  • the present application relates to the technical field of communications, and in particular to a traffic management method, device, equipment, and computer-readable storage medium.
  • the present application provides a flow management method, device, equipment and computer-readable storage medium to realize flow management through a simple network architecture, and the technical solution is as follows.
  • a traffic management method is provided, the method is applied to a broadband access device, and the method includes:
  • the broadband access device receives the authentication authorization accounting (authentication authorization accounting, AAA) server sends authentication authorization accounting information and service awareness (service aware, SA) policy, the SA policy is used to indicate the flow of the target service for the first user processing method. Afterwards, the broadband access device implements the access authentication process of the first user according to the authentication authorization and charging information, and implements the charging process of the traffic of the first user.
  • AAA authentication authorization accounting
  • SA service awareness
  • the AAA server can issue both authentication, authorization, and accounting information and SA policies.
  • the broadband access device In addition to obtaining authentication, authorization and accounting information, the broadband access device also obtains SA policies. Therefore, there is no need to separately set up two different servers in the network architecture, thereby simplifying the network architecture for performing service-aware traffic management, and realizing service-aware traffic management through a simple network architecture.
  • the broadband access device is further configured to execute the function of the SA foreground module, and the method further includes: the broadband access device processes the traffic of the target service from the first user according to the SA policy.
  • the broadband access device processes the traffic according to the SA policy.
  • the SA capability is realized in the broadband service, and the quality of the broadband service and the communication experience of the first user are improved.
  • the broadband access device can be a broadband access device, such as a traditional broadband network gateway (broadband network gateway, BNG) device, or a broadband remote access server (Broadband Remote Access Server, BRAS), or a Virtual broadband network gateway (vBNG) system.
  • BNG broadband network gateway
  • BRAS broadband Remote Access Server
  • vBNG Virtual broadband network gateway
  • the broadband access device is also integrated with an SA foreground module to perform the function of the SA foreground module.
  • the method further includes: the broadband access device receives the first message, the broadband access device determines that the first message belongs to the first user, and the broadband access device determines that the first message belongs to the target service;
  • the broadband access device processes the traffic of the target service from the first user according to the SA policy, including: based on the fact that the first packet belongs to the first user and belongs to the target service, the broadband access device processes the traffic of the first user according to the processing method in the SA policy. A message is processed.
  • the broadband access device determining that the first packet belongs to the first user includes: the broadband access device determining that the first packet belongs to the first user based on a source address of the first packet. This determination method is more flexible and simple.
  • the method further includes: obtaining, by the broadband access device, statistical information on traffic of the target service from the first user.
  • the statistical information can be sent to the SA background device, and the statistical information can be used in the charging process, and can also be used in other processes such as data analysis.
  • the broadband access device is a vBNG system
  • the vBNG system includes a control plane (control plane, CP) device and a user plane (user plane, UP) device
  • the CP device is used to receive the SA sent by the AAA server.
  • Policy the UP device is used to implement the function of the SA front-end module.
  • the CP device is used to implement the function of the SA background module.
  • the SA policy delivered by the AAA server is first sent to the CP device in the vBNG system, and then passed to the UP device by the CP device. Therefore, the method can be combined with a vBNG system in which the user plane is separated from the control plane (control user plane separation, CU separation).
  • the method further includes: the CP device sends the SA policy to the UP device through a control plane and user plane separated protocol (control plane user plane separated protocol, CUSP).
  • a control plane and user plane separated protocol control plane user plane separated protocol, CUSP.
  • the broadband access device is a CP device in the vBNG system
  • the method further includes: the CP device sends an SA policy to the SA foreground device, and the SA foreground device is used to check the information from the first user according to the SA policy.
  • the traffic of the target business is processed.
  • the CP device and the SA background device can be independent of each other, and the SA background device can perform other related functions besides delivering the SA policy to the SA front-end device.
  • the SA background device receives the target business statistics sent by the SA front-end device. information.
  • the CP device sending the SA policy to the SA foreground device includes: the CP device sends the SA policy to the SA foreground device through CUSP.
  • the SA policy is carried in the type length value (type length value, TLV) field of the CUSP message.
  • TLV type length value
  • the SA policy includes the corresponding relationship between the identification of the target service and the processing method, wherein the identification of the target service includes at least one of the following: application layer protocol identification, application layer protocol group identification, uniform resource locator (uniform resource locator, URL) identifier or URL group identifier.
  • the identification of the target service includes at least one of the following: application layer protocol identification, application layer protocol group identification, uniform resource locator (uniform resource locator, URL) identifier or URL group identifier.
  • the broadband access device receives the authentication, authorization and accounting information and the SA policy sent by the AAA server, including: the broadband access device uses remote authentication dial in user service (RADIUS)
  • the protocol receives authentication, authorization, accounting information and SA policies sent by the AAA server.
  • the AAA server can be a RADIUS server.
  • the RADIUS server can deliver the SA policy through the extended RADIUS protocol, and the SA policy is included in the extended TLV field.
  • the broadband access device receives the authentication, authorization and charging information and the SA policy sent by the AAA server, including: the broadband access device passes the policy and charging rules function (PCRF) protocol Receive authentication, authorization, and accounting information and SA policies sent by the AAA server.
  • the AAA server may be a PCRF server.
  • the PCRF server may deliver the SA policy through the extended PCRF protocol, and the SA policy is included in the extended TLV field.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a traffic management method is provided, the method is applied to an AAA server, and the method includes:
  • the AAA server sends an SA policy to the target device, where the SA policy indicates a processing manner for the traffic of the target service of the first user.
  • the AAA server can also deliver the SA policy. Therefore, there is no need to separately set up two different servers in the network architecture, thereby simplifying the network architecture for performing service-aware traffic management, and realizing service-aware traffic management through a simple network architecture.
  • the target device is a broadband access device
  • the method further includes: the AAA server sends authentication, authorization, and accounting information to the broadband access device, and the authentication, authorization, and accounting information is used by the broadband access device to implement the first user The access authentication process and the accounting process of the traffic of the first user.
  • the broadband access device obtains SA policy information in addition to authentication, authorization and accounting information.
  • the broadband access device may be a broadband access device, such as a traditional BNG device, or a vBNG system.
  • the broadband access device includes a CP device in the vBNG system.
  • the CP device may further transfer the SA device to the UP device, and the UP device is used to execute the function of the SA foreground module.
  • the target device is an SA background device
  • the method further includes: the AAA server sends authentication, authorization, and accounting information to the broadband access device, and the authentication, authorization, and accounting information is used by the broadband access device to implement authentication of the first user.
  • the SA background device and the broadband access device may be independent devices, and the AAA server sends the SA policy and authentication, authorization and accounting information to the SA background and the broadband access device respectively.
  • the broadband access device may be a broadband access device, such as a traditional BNG device, or a vBNG system.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a traffic management method is provided, the method is applied to the SA background device, and the method includes:
  • the SA background device receives the SA policy sent by the AAA server, and the SA policy indicates the processing mode for the traffic of the target service of the first user.
  • the SA background device receives the SA policy from the AAA server, and the AAA server can deliver authentication, authorization, and accounting information as well as the SA policy. Therefore, there is no need to separately set up two different servers in the network architecture, thereby simplifying the network architecture for performing service-aware traffic management, and realizing service-aware traffic management through a simple network architecture.
  • the method further includes: the SA background device sends the SA policy to the SA foreground device.
  • the SA background device sends the SA policy to the SA foreground device, including: based on the request message sent by the SA foreground device, the SA background device sends the SA policy to the SA foreground device, and the request message includes the first user's corresponding source address.
  • the SA foreground device requests the SA policy of the first user corresponding to the source address based on the source address, so as to process the traffic of the target service from the first user.
  • the SA background device is used to perform the function of the CP module in the vBNG system
  • the SA foreground device is used to perform the function of the UP module in the vBNG system.
  • the method also includes: the SA background device receives the AAA server sent
  • the authentication, authorization, and accounting information is used by the CP module and the UP module to implement the first user's access authentication process and the first user's traffic accounting process.
  • the CP device is used to execute the function of the SA background module, thus, this method can be combined with the vBNG system in which the CU is separated.
  • the SA background device sends the SA policy to the SA foreground device, including: the SA background device sends the SA policy to the SA foreground device through CUSP.
  • the SA policy issued by the AAA server is first sent to the CP device in the vBNG system, and then the CP device transmits it to the UP device through the extended CUSP.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a traffic management device is provided, the device is applied to broadband access equipment, and the device includes:
  • a receiving module configured to receive authentication, authorization, and accounting information and an SA policy sent by the AAA server, where the SA policy indicates a processing method for the traffic of the target service of the first user;
  • An implementation module configured to implement the access authentication process of the first user and the accounting process of the traffic of the first user according to the authentication authorization charging information.
  • the broadband access device is further configured to execute the function of the SA foreground module, and the device further includes: a processing module, configured to process the traffic of the target service from the first user according to the SA policy.
  • the receiving module is also configured to receive the first message
  • the device also includes: a determining module, configured to determine that the first message belongs to the first user; determine that the first message belongs to the target service;
  • the processing module is configured to process the first packet according to the processing manner in the SA policy based on the fact that the first packet belongs to the first user and belongs to the target service.
  • the determining module is configured to determine that the first packet belongs to the first user based on the source address of the first packet.
  • the device further includes: an obtaining module, configured to obtain statistical information of traffic of the target service from the first user.
  • the broadband access device is a vBNG system.
  • the vBNG system includes a CP device and a UP device.
  • the CP device is used to receive the SA policy sent by the AAA server, and the UP device is used to execute the function of the SA foreground module.
  • the apparatus further includes: a first sending module, configured for the CP device to send the SA policy to the UP device through CUSP.
  • the broadband access device is a CP device in the vBNG system
  • the device further includes: a second sending module, used for the CP device to send the SA policy to the SA foreground device, and the SA foreground device is used to The traffic of the target service from the first user is processed.
  • the second sending module is configured for the CP device to send the SA policy to the SA foreground device through CUSP.
  • the SA policy is carried in the TLV field of the CUSP message.
  • the SA policy includes the correspondence between the identification of the target service and the processing method, wherein the identification of the target service includes at least one of the following: application layer protocol identification, application layer protocol group identification, URL identification or URL Group ID.
  • the receiving module is configured to receive the authentication, authorization and accounting information and the SA policy sent by the AAA server through the RADIUS protocol.
  • the receiving module is configured to receive the authentication, authorization and accounting information and the SA policy sent by the AAA server through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a traffic management device is provided, the traffic management device is applied to an AAA server, and the device includes:
  • a sending module configured to send an SA policy to the target device, where the SA policy indicates a processing manner for the traffic of the target service of the first user.
  • the target device is a broadband access device
  • the sending module is further configured to send authentication, authorization and charging information to the broadband access device, and the authentication, authorization and charging information is used by the broadband access device to implement the first user The access authentication process and the accounting process of the traffic of the first user.
  • the broadband access device includes a CP device in the vBNG system.
  • the target device is an SA background device
  • the sending module is further configured to send authentication, authorization and charging information to the broadband access device, and the authentication, authorization and charging information is used by the broadband access device to implement the authentication of the first user.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a flow management device is provided, the device is applied to SA background equipment, and the device includes:
  • the receiving module is configured to receive the SA policy sent by the AAA server, where the SA policy indicates a processing method for the traffic of the target service of the first user.
  • the apparatus further includes: a sending module, configured to send the SA policy to the SA foreground device.
  • the sending module is configured to send the SA policy to the SA foreground device based on a request message sent by the SA foreground device, where the request message includes a source address corresponding to the first user.
  • the SA background device is used to perform the function of the CP module in the vBNG system
  • the SA foreground device is used to perform the function of the UP module in the vBNG system
  • the receiving module is also used to receive the information sent by the AAA server.
  • the authentication, authorization, and accounting information is used by the CP module and the UP module to implement the access authentication process of the first user and the accounting process of the traffic of the first user.
  • the sending module is configured to send the SA policy to the SA foreground device through CUSP.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • a broadband access system includes a broadband access device, an AAA server, and an SA background device, wherein,
  • the AAA server is used to send the SA policy to the SA background device, the SA policy indicates the processing mode of the target service traffic of the first user, and send the authentication, authorization and charging information to the broadband access device, and the authentication, authorization and charging information is used for
  • the broadband access device implements the access authentication process of the first user and the charging process of the traffic of the first user.
  • the broadband access device is also used to execute the function of the SA foreground module, and the SA background device is used to send the SA policy to the broadband access device;
  • the traffic of a user's target service is processed.
  • a broadband access system includes a broadband access device and an AAA server, wherein,
  • the AAA server is used to send authentication, authorization and accounting information and an SA policy to the broadband access device, and the SA policy indicates a processing method for the traffic of the target service of the first user;
  • the broadband access device is used to realize the access authentication process of the first user and the charging process of the traffic of the first user according to the authentication, authorization and charging information; and process the traffic of the target service from the first user according to the SA policy.
  • a broadband access system includes an SA background device and an AAA server, wherein,
  • the AAA server is used to send authentication, authorization, and accounting information and an SA policy to the SA background device, and the SA policy indicates a processing method for the traffic of the target service of the first user;
  • the SA background device is used to realize the access authentication process of the first user and the charging process of the first user's flow according to the authentication, authorization and charging information, and the SA background device is used to perform the function of the CP module in the vBNG system;
  • the device sends the SA policy, and the SA foreground device is used to perform the function of the UP module in the vBNG system.
  • a traffic management device in a tenth aspect, includes a memory and a processor; at least one instruction is stored in the memory, and at least one instruction is loaded and executed by the processor, so that the traffic management device implements the first aspect and the first A method in any possible implementation of an aspect.
  • a traffic management device which includes a memory and a processor; at least one instruction is stored in the memory, and at least one instruction is loaded and executed by the processor, so that the traffic management device realizes the above-mentioned second aspect and the first A method in any possible implementation of the two aspects.
  • a flow management device which includes a memory and a processor; at least one instruction is stored in the memory, and at least one instruction is loaded and executed by the processor, so that the flow management device realizes the above-mentioned third aspect and the first A method in any of the possible implementations of the three aspects.
  • processors there are one or more processors, and one or more memories.
  • the memory may be integrated with the processor, or the memory may be separated from the processor.
  • the memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged in different On the chip, the application does not limit the type of the memory and the arrangement of the memory and the processor.
  • a non-transitory memory such as a read-only memory (read only memory, ROM)
  • ROM read only memory
  • a computer program includes: computer program code, when the computer program code is run by a computer, it causes the computer to execute the methods in the above aspects.
  • a computer-readable storage medium stores programs or instructions. When the programs or instructions are run on a computer, the methods in the above aspects are executed.
  • a chip including a processor, configured to call and execute instructions stored in the memory from the memory, so that the communication device installed with the chip executes the methods in the above aspects.
  • another chip including: an input interface, an output interface, a processor, and a memory, the input interface, the output interface, the processor, and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory , when the code is executed, the processor is configured to execute the methods in the above aspects.
  • a seventeenth aspect provides a network system, the system includes a broadband access device, an AAA server, and an SA background device, and the broadband access device is used to implement the first aspect and any possible implementation of the first aspect
  • the AAA server is used to execute the method in the above-mentioned second aspect and any possible implementation of the second aspect
  • the SA background device is used to execute the above-mentioned third aspect and any possible implementation of the third aspect methods in methods.
  • FIG. 1 is a schematic diagram of a multi-layer protocol provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of implementing SA capabilities in a related technology provided by an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of an SA foreground module and an SA background module provided by an embodiment of the present application;
  • FIG. 4 is a schematic structural diagram of an implementation environment provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a flow management system provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a flow management system provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a traffic management system provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a traffic management system provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a traffic management system provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a flow management system provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a flow management system provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a traffic management system provided by an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of a flow management method provided in an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of a traffic management method provided in an embodiment of the present application.
  • FIG. 15 is a schematic flowchart of a traffic management method provided in an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a flow management device provided by an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a traffic management device provided by an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a flow management device provided by an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a traffic management device provided by an embodiment of the present application.
  • the broadband service is one of the methods of traffic management, providing broadband services through a simple network architecture, that is, implementing traffic management through a simple network architecture.
  • the SA capability includes the deep packet inspection (DPI) capability, and the SA capability refers to the ability to identify the business to which the user's traffic belongs, and process the traffic based on the business to which it belongs.
  • the service to which it belongs includes but is not limited to a certain URL, a certain URL group, or a certain application program (Application, APP), and a certain APP group.
  • the SA capability depends on the device's ability to identify protocols from layer 5 (layer 5, L5) to layer 7 (layer 7, L7).
  • the network architecture that provides broadband services does not have the SA capability.
  • the protocols of the above layers can be referred to in FIG. 1 .
  • the L2 protocol includes a medium access control (medium access control, MAC) protocol
  • the L3 protocol includes an Internet protocol (Internet protocol, IP)
  • the L4 protocol includes a transmission control protocol (transmission control protocol, TCP) or a user data packet protocol ( user datagram protocol, UDP)
  • L5-L7 protocols include hypertext transfer protocol (hyper text transfer protocol, HTTP).
  • an SA foreground module and an SA background module are added based on devices included in a network architecture for providing broadband services.
  • an independent server is deployed, and the SA policy is delivered through the independent server.
  • the SA front-end module and the SA background module realize the SA capability based on the SA policy.
  • related technologies also need to deploy another independent server to issue authentication, authorization and accounting information to devices included in the network architecture for providing broadband services.
  • SA foreground module is integrated in BNG in the related art, forms BNG/SA foreground, and combines SA background, server A and server B (server A and server B are two different servers), through Fig. 2 The steps shown are to implement the SA capability.
  • Server A sends the SA policy to the SA background to form a correspondence between user identification (identification, ID) and the SA policy.
  • the user terminal sends an online request to the BNG/SA front desk.
  • the BNG/SA front desk sends an authentication and authorization message to the server B to implement authentication and authorization of the user terminal.
  • the BNG/SA front desk copies the authentication and authorization message to the SA background, and the authentication and authorization message carries the IP address and the user ID.
  • the SA background generates the correspondence between the IP address and the user ID according to the authentication and authorization message.
  • the traffic of the user terminal reaches the BNG/SA front desk, the BNG diverts the traffic to the SA front desk, and the SA front desk extracts the IP address of the traffic.
  • the SA front end uses the IP address of the traffic to request the SA policy from the SA back end.
  • the SA background searches for the corresponding relationship between the IP address and the user ID, and the corresponding relationship between the user ID and the SA policy, to obtain the SA policy.
  • the SA background issues an SA policy.
  • the SA front desk executes the SA policy, and processes the traffic according to the SA policy.
  • the SA front desk collects traffic related information and reports it to the SA background for billing.
  • FIG. 3 shows a schematic structural diagram of the SA foreground module and the SA background module.
  • the SA front-end module is connected with the SA back-end module
  • the SA front-end module includes a service aware function (SAF) unit
  • the SA back-end module includes a data analysis function (DAF) unit and a policy control function (policy control function) , PCF) unit.
  • SAF service aware function
  • DAF data analysis function
  • PCF policy control function
  • the SAF unit is used to identify the service that the user's traffic belongs to according to the SA policy and feature library issued by the PCF unit, process the user's traffic according to the SA policy based on the service to which the user belongs, collect statistics on the user's traffic-related information, and report to DAF unit.
  • the DAF unit is used to receive and store the statistical information of the SAF unit (for example, store it in a database), perform data analysis (for example, billing) based on the received information and the SA policy issued by the PCF unit, and obtain the data analysis result, according to the analysis
  • the result notifies the PCF unit to update the SA policy issued to the SAF unit, and presents the data analysis result in the form of a report (for example, to the operator).
  • the PCF unit is used to provide a human-computer interaction interface and an operator docking interface, support the generation of SA policies and signature databases, deliver SA policies to the SAF unit and DAF unit, and deliver the signature database to the SAF unit.
  • the embodiment of the present application provides a traffic management method, which can be applied to a network architecture providing broadband services, and the network architecture is used for user terminals to access a destination network.
  • the network architecture can transmit the traffic of the user to the destination network, so that the user can use the user terminal to surf the Internet.
  • the target network includes but is not limited to the Internet (internet), and this embodiment of the present application does not limit the target network.
  • a user terminal a residential gateway (residential gateway, RG), an optical network terminal (optical network terminal, ONT), an optical line terminal (optical line terminal, OLT), traffic management system, fixed network and destination network are connected in sequence.
  • the fixed network includes but is not limited to at least one of the following networks: an acceleration channel network and a public Internet backbone network.
  • the user terminal accesses the fixed network through the RG, ONT, and OLT, and then accesses the destination network through the fixed network.
  • the traffic management system can manage the user's traffic.
  • the traffic management system may include multiple devices, a first device among the multiple devices is directly connected to the OLT and a fixed network, and a second device among the multiple devices is connected to the first device.
  • the first device includes at least one device among the multiple devices, and the second device includes other devices among the multiple devices except the first device.
  • the first device is located on the transmission path of the user's traffic, and the second device is bypassed.
  • the types of the first device and the second device refer to the subsequent descriptions of FIG. 6-FIG. 12 .
  • the traffic management system includes a broadband access device and an AAA server, and the broadband access device is connected to the AAA server.
  • the broadband access device may include a broadband network gateway (BNG), also known as a broadband remote access server.
  • BNG broadband network gateway
  • the broadband access device includes a BNG module, and the BNG module may be implemented by forwarding devices such as routers and switches.
  • the traffic management system may also include an SA background module.
  • the SA background module may be implemented by a computer device, such as a server device.
  • the broadband access device further includes an SA foreground module.
  • the SA front-end module may be implemented by a plug-in card, and the plug-in card may be plugged into forwarding devices such as routers and switches.
  • embodiments of the present application provide the following types of traffic management systems.
  • the traffic management system includes broadband access equipment and AAA server, and the traffic management system also includes an SA background module.
  • Broadband access equipment includes BNG module and SA front-end module.
  • the AAA server, BNG module, SA foreground module and SA background module are connected in sequence.
  • the SA background module and the SA foreground module are previously connected through a private interface.
  • the functions of the BNG module and the SA foreground module may be implemented by the BNG device.
  • the SA background module may be located on other devices than the broadband access device.
  • the function of the SA background module can be realized by the SA background device.
  • Type 2 see FIG. 7 , on the basis of Type 1 shown in FIG. 6 , the SA background module is also connected to the AAA server.
  • the traffic management system includes a broadband access device and an AAA server
  • the broadband access device is a vBNG system
  • the vBNG system includes a CP device and a UP device.
  • the AAA server, CP device, and UP device are connected in sequence.
  • the BNG module included in the broadband access device described above is embodied as a CP device and a UP device.
  • the CP device includes the SA background module
  • the UP device includes the SA foreground module.
  • the CP device including the SA background module is connected to the UP device including the SA foreground module
  • the AAA server is connected to the CP device including the SA background module. That is to say, the UP device including the SA foreground module is located on the transmission path of user traffic, and the CP device including the SA background module and the AAA server are bypassed.
  • the traffic management system includes a broadband access device and an AAA server, and the broadband access device is the CP device in the vBNG system.
  • the CP device in the vBNG system includes the SA background module.
  • the flow management system also includes an SA foreground device, which realizes the function of the SA foreground module.
  • the AAA server, the CP device including the SA background module, and the SA foreground device are connected in sequence.
  • the CP device including the SA background module is connected to the SA foreground device
  • the AAA server is connected to the CP device including the SA background module. That is to say, the SA foreground device is located on the transmission path of user traffic, including the CP device of the SA background module and the AAA server.
  • the CP device in the vBNG system may not include the SA background module, that is, the SA background module is located in other devices than the CP device.
  • the SA background module is located in other devices than the CP device.
  • the traffic management system includes a broadband access device and an AAA server, and the traffic management system also includes an SA background module.
  • Broadband access equipment includes CP module, UP module and SA foreground module.
  • the AAA server, CP module, UP module, SA foreground module, and SA background module are connected in sequence.
  • the function of the CP module can be realized by the CP device, and the functions of the UP module and the SA foreground can be realized by the UP device.
  • the function of the SA background module can be realized by the SA background device, and the SA background device and the SA front-end module are connected through a private interface.
  • Type 6 see FIG. 11 , on the basis of Type 5 shown in FIG. 10 , the SA background module is also connected to the AAA server.
  • the traffic management system includes a broadband access device and an AAA server.
  • the broadband access device includes an SA front-end device and an SA background device.
  • the SA front-end device implements the function of the UP module
  • the SA background device implements the CP module. Function.
  • the AAA server, the SA background device including the CP module, and the SA foreground device including the UP module are connected in sequence.
  • SA front-end equipment including UP module is connected with the SA front equipment including the UP module
  • the AAA server is connected with the SA background equipment including the CP module. That is to say, the SA foreground device including the UP module is located on the transmission path of user traffic, and the SA background device including the CP module and the AAA server are bypassed.
  • An embodiment of the present application provides a traffic management method, which is applied to broadband access devices included in the above-mentioned various types of traffic management systems. As shown in FIG. 13 , the method includes the following steps 1301 and 1302 .
  • the broadband access device receives authentication, authorization, and accounting information and an SA policy sent by the AAA server, where the SA policy indicates a processing manner for traffic of a target service of the first user.
  • the authentication, authorization and charging information includes authentication and authorization information and charging information
  • the authentication and authorization information is used to realize the access authentication process of the first user
  • the charging information is used to realize the charging process of the traffic of the first user.
  • the charging process of the traffic of the first user includes: the charging process of the traffic of the first user.
  • the above charging process for the flow of the first user may not distinguish the service to which the flow belongs.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the BNG module receives authentication, authorization, and accounting information and SA policies from the AAA server.
  • the BNG module sends the SA policy to the SA foreground module.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the BNG module receives authentication, authorization and accounting information from the AAA server
  • the SA background module receives the SA policy from the AAA server
  • the SA background module sends the SA policy to the SA front-end module.
  • the broadband access device includes a CP device and a UP device
  • the CP device includes an SA background module
  • the UP device includes an SA foreground module.
  • the CP device receives the authentication, authorization and accounting information and the SA policy from the AAA server, and the CP device sends the SA policy to the UP device, so that the SA front-end module included in the UP device obtains the SA policy.
  • the broadband access device includes a CP device, and the CP device includes an SA background module.
  • the CP device receives authentication, authorization, and accounting information and SA policies from the AAA server, and the CP device sends the SA policies to the SA foreground device.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the CP module receives the authentication, authorization and accounting information and the SA policy from the AAA server, the CP module sends the SA policy to the UP module, and the UP module sends the SA policy to the SA front-end module.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the CP module receives authentication, authorization and accounting information from the AAA server
  • the SA background module receives the SA policy from the AAA server
  • the SA background module sends the SA policy to the SA front-end module.
  • the broadband access device includes an SA foreground device and an SA background device
  • the SA foreground device includes an UP module
  • the SA background device includes a CP module.
  • the SA background device receives authentication, authorization, and accounting information and SA policy from the AAA server
  • the CP module included in the SA background device obtains the authentication, authorization and accounting information
  • the SA background device sends the SA policy to the SA foreground device.
  • the SA policy can be sent through CUSP.
  • a TLV field can be added in the extended CUSP protocol, and the SA policy is carried in the newly added TLV field.
  • the SA policy includes the corresponding relationship between the identification of the target service and the processing mode, and the identification of the target service includes at least one of the following: application layer protocol identification, application layer protocol group identification, URL identification or URL group identification, the embodiment of the present application
  • the identification of the target business is not limited.
  • the processing manner may include a processing action.
  • the processing manner includes but is not limited to at least one of blocking (block), mirroring (mirror), bandwidth control, and redirection, and this embodiment does not limit the processing manner.
  • blocking refers to terminating the transmission process of traffic.
  • Mirroring refers to the duplication of traffic, the original traffic is transmitted normally, and the copied traffic is used for data analysis.
  • Bandwidth control refers to determining the network used to transmit traffic. For example, if the traffic requires a large bandwidth, the acceleration channel network is used to transmit the traffic. If the traffic does not require a large bandwidth, the public Internet backbone network is used to transmit the traffic. The traffic transmission can be controlled through the bandwidth control process.
  • rate Redirection refers to changing the routing information of traffic, and transmitting traffic through devices with different loads, so as to control the transmission rate of traffic.
  • the embodiment of the present application needs to extend the CUSP, so that the CP device can send the SA policy through the CUSP.
  • the SA policy is carried in the TLV field of the CUSP message, and the CUSP message is a message using CUSP.
  • the TLV field includes a first TLV field, and the first TLV field carries a URL group identifier and/or a protocol group identifier, wherein the URL group identifier and/or protocol group identifier are used to identify the target service targeted by the SA policy , see Table 1 below for the first TLV field.
  • URL group ID list the list unlimited Protocol group ID list (protocol group ID list)
  • the URL group identifier list includes at least one URL group identifier, one URL group identifier is used to uniquely indicate one URL group, and one URL group includes at least one URL.
  • the protocol group identification list includes at least one protocol group identification, one protocol group identification is used to uniquely indicate one protocol group, and one protocol group includes at least one protocol.
  • the TLV field also includes a second TLV field and/or a third TLV field, the second TLV field carries the URL group identifier and the processing method corresponding to the URL group identifier, and the third TLV field carries the protocol group identifier and the processing method corresponding to the protocol group identifier Way. See Table 2 below for the second TLV field, and Table 3 below for the third TLV field. In Table 2 and Table 3, action is the action included in the processing mode.
  • the AAA server includes a RADIUS server.
  • authentication, authorization, accounting information and SA policies are sent by the RADIUS server through the RADIUS protocol.
  • an SA policy can be uniquely indicated by a policy ID, and when sending the SA policy, it is also necessary to send the policy ID for indicating the SA policy. Therefore, the embodiment of the present application needs to extend the RADIUS protocol so that the RADIUS protocol can carry the policy ID.
  • the policy ID is carried in the TLV field of the RADIUS message, and the RADIUS message is a message using the RADIUS protocol.
  • the extension to the RADIUS protocol includes: adding the fourth TLV field shown in Table 4 below.
  • the length of the type field is, for example, 1-31 (excluding the terminator), the length of the length field is, for example, 3-33, and the value field is used to carry the policy ID.
  • the AAA server includes a PCRF server. Authentication, authorization, accounting information and SA policies are sent by the PCRF server through the PCRF protocol.
  • the extension manner of the PCRF protocol may be similar to the extension manner of the RADIUS protocol, which will not be repeated here.
  • the broadband access device implements an access authentication process for the first user and a charging process for traffic of the first user according to the authentication, authorization, and charging information.
  • the access authentication process of the first user is also called the dial-up Internet access process of the first user.
  • the user terminal used by the first user sends a request through a point-to-point protocol over Ethernet (PPPoE), and the request includes the user ID of the first user corresponding to the user terminal.
  • the ID is used to uniquely indicate the user terminal used by the first user.
  • the AAA server will receive the authentication and authorization message sent based on the request.
  • the authentication and authorization message carries the user ID and IP address, and the IP address is the address that needs to be assigned to the user terminal.
  • the AAA server parses the authentication and authorization message to obtain the user ID, confirms whether the user terminal indicated by the user ID can access the Internet (that is, access the destination network) and the authority it has after accessing the Internet, and obtains the authentication and authorization information. If the authentication and authorization information indicates that the user terminal can access the Internet and has a certain authority, the above IP address will be assigned to the user terminal. After the user terminal obtains the IP address, the user terminal can use the IP address to send a message, and the sent message carries the IP address.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the BNG module receives the request sent by the user terminal, the BNG module determines the IP address that needs to be allocated to the user terminal, generates an authentication and authorization message based on the user ID and IP address carried in the request, and sends the authentication and authorization message to the AAA server. Afterwards, the BNG module receives the authentication and authorization information sent by the AAA server, and if the authentication and authorization indicates that the user terminal can access the Internet and has a certain authority, the BNG module assigns the IP address to the user terminal.
  • the broadband access device includes a BNG module and an SA foreground module, case 2 is the same as case 1, and will not be repeated here.
  • the broadband access device includes a CP device and a UP device
  • the CP device includes an SA background module
  • the UP device includes an SA foreground module.
  • the UP device receives the request sent by the user terminal, and forwards the request to the CP device.
  • the CP device determines the IP address to be allocated to the user terminal, generates an authentication and authorization packet based on the user ID and IP address carried in the request, and sends the authentication and authorization packet to the AAA server.
  • the CP device receives the authentication and authorization information sent by the AAA server. If the authentication and authorization information indicates that the user terminal can access the Internet and has a certain authority, the CP device sends the IP address to the UP device, and the UP device assigns the IP address to the user terminal.
  • the broadband access device includes a CP device, and the CP device includes an SA background module.
  • the SA foreground device receives the request sent by the user terminal, and forwards the request to the CP device.
  • the CP device determines the IP address to be allocated to the user terminal, generates an authentication and authorization packet based on the user ID and IP address carried in the request, and sends the authentication and authorization packet to the AAA server.
  • the CP device receives the authentication and authorization information sent by the AAA server. If the authentication and authorization information indicates that the user terminal can access the Internet and has certain permissions, the CP device sends the IP address to the SA foreground device, and the SA foreground device assigns the IP address to the user terminal. address.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the UP module receives the request sent by the user terminal, and forwards the request to the CP module.
  • the CP module determines the IP address that needs to be allocated to the user terminal, generates an authentication and authorization message based on the user ID and IP address carried in the request, and sends the authentication and authorization message to the AAA server.
  • the CP module receives the authentication and authorization information sent by the AAA server. If the authentication and authorization information indicates that the user terminal can access the Internet and has a certain authority, the CP module sends the IP address to the UP module, and the UP module assigns the IP address to the user terminal.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • Situation 6 is the same as Situation 5, and will not be repeated here.
  • the broadband access device includes an SA foreground device and an SA background device.
  • the SA foreground equipment includes an UP module
  • the SA background equipment includes a CP module.
  • the SA foreground device receives the request sent by the user terminal, and forwards the request to the SA background device.
  • the CP module included in the SA background device determines the IP address that needs to be allocated to the user terminal, and generates an authentication and authorization message based on the user ID and IP address carried in the request, so that the SA background device sends an authentication and authorization message to the AAA server.
  • the SA background device receives the authentication and authorization information sent by the AAA server. If the authentication and authorization information indicates that the user terminal can access the Internet and has certain permissions, the SA background device sends the IP address to the SA foreground device, and the SA foreground device assigns the IP address to the user terminal. the IP address.
  • the ways in which various types of traffic management systems implement the charging process of the traffic of the first user according to the charging information are described through cases 1 to 7.
  • the traffic of the first user includes the traffic of the reference service of the first user, and the reference service does not need to use the SA policy.
  • the statistical information of the traffic of the reference service of the first user (hereinafter referred to as the first statistical information) is obtained through statistics, and then the traffic of the reference service of the first user is calculated based on the charging information and the first statistical information. for billing.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the BNG module obtains the first statistical information through statistics, and performs charging based on the charging information and the first statistical information.
  • the broadband access device includes a BNG module and an SA foreground module. Case 2 is the same as Case 1 above, and will not be repeated here.
  • the broadband access device includes a CP device and a UP device
  • the CP device includes an SA background module
  • the UP device includes an SA foreground module.
  • the UP device obtains the first statistical information through statistics, and sends the first statistical information to the CP device, and the CP device performs charging based on the received first statistical information and charging information.
  • the broadband access device includes a CP device, and the CP device includes an SA background module.
  • the SA foreground device obtains the first statistical information through statistics, and sends the first statistical information to the CP device, and the CP device performs charging based on the charging information and the first statistical information.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the UP module obtains the first statistical information through statistics, and sends the first statistical information to the CP module, and the CP module performs charging based on the charging information and the first statistical information.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • Situation 6 is the same as Situation 5, and will not be repeated here.
  • the broadband access device includes an SA foreground device and a CP module
  • the SA foreground device includes an UP module
  • the CP module is located in the SA background device.
  • the UP module included in the SA foreground device collects the first statistical information
  • the SA foreground device sends the first statistical information to the SA background device
  • the CP module included in the SA background device performs charging based on the charging information and the first statistical information.
  • the SA foreground module also processes the traffic of the target service from the first user according to the SA policy. Therefore, when the broadband access device includes the SA foreground module, the broadband access device can process the traffic of the target service from the first user according to the SA policy.
  • the broadband access devices shown in FIG. 6 , FIG. 7 , FIG. 8 , FIG. 10 , FIG. 11 and FIG. 12 can process the traffic of the target service from the first user according to the SA policy.
  • the SA foreground device shown in FIG. 9 can also process the traffic of the target service from the first user according to the SA policy.
  • the traffic of the target service from the first user includes a first packet, and the first packet is sent by a user terminal used by the first user.
  • the first message is transmitted to the traffic management system through the RG device, the ONT device and the OLT device in sequence.
  • the method further includes that the SA foreground module receives the first message, determines that the first message belongs to the first user, and determines that the first message belongs to the target service.
  • Process the traffic of the target service from the first user according to the SA policy including: the SA front-end module processes the first message according to the processing method in the SA policy based on the fact that the first message belongs to the first user and belongs to the target service .
  • the SA foreground module determining that the first packet belongs to the first user includes: the SA foreground module determining that the first packet belongs to the first user based on the source address of the first packet.
  • the source address of the first message can be obtained by parsing the first message, and the source address of the first message is the IP address assigned to the user terminal sending the first message during the access authentication process. Therefore, if the source address of the first packet is the same as the IP address allocated to the user terminal used by the first user, it can be determined that the first packet belongs to the first user.
  • the SA foreground module determining that the first packet belongs to the target service includes: the SA foreground module identifies the first user through a feature database, and obtains the service to which the first user belongs. If the service to which the first user belongs is the same as the target service, it can be determined that the first packet belongs to the target service.
  • the feature library is a binary data file, and the feature library is generated by the SA background module and sent to the SA front end.
  • the signature library may include identification signatures specific to application layer protocols and applications. When performing application layer protocol or application program identification, the identification engine included in the SA foreground will analyze the characteristics of the data message, compare it with various identification characteristics in the signature database, and obtain the identification result according to the comparison result.
  • the SA foreground module stores the first correspondence between active source addresses and policy IDs. Since the source address of the first message can be obtained by parsing the first message, the first corresponding relationship can be queried according to the source address of the first message to obtain the policy ID corresponding to the source address, thereby obtaining the SA policy indicated by the policy ID. It can be known from the above that the SA policy includes the corresponding relationship between the identifier of the target service and the processing mode, so the service indicated by the identifier of the target service included in the SA policy is the target service.
  • the SA policy After determining that the first packet belongs to the first user and belongs to the target service according to the above description, query the SA policy to obtain the processing method corresponding to the identifier of the target service, so that the first packet can be processed according to the processing method in the SA policy.
  • the SA policy includes the correspondence between the URL identifier (ie, the identifier of the target service) and the bandwidth control (ie, the processing method) used to indicate the use of the accelerated channel network. If it is determined that the first message belongs to the first user and belongs to the URL indicated by the URL identifier, then the accelerated channel network is used to transmit the first message, thereby performing accelerated transmission of the first message.
  • the first packet when the first packet belongs to the first user but does not belong to the target service, there is no need to query the SA policy, and the first packet can be directly processed according to the reference method.
  • the SA policy including the correspondence between the URL identifier and the bandwidth control used to indicate the use of the accelerated channel network as an example, if it is determined that the first message belongs to the first user and does not belong to the URL indicated by the URL identifier, then The first packet is not transmitted through the accelerated channel network, but is transmitted according to a reference method, for example, using a public interconnected backbone network. In this case, the accelerated transmission of the first packet is not performed.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the BNG module receives the first message sent by the user terminal, and the SA foreground module obtains the first message through the BNG module. After the SA foreground module determines that the first message belongs to the first user and belongs to the target service, it processes the first message according to the processing mode in the SA policy.
  • both the SA policy used by the SA foreground module and the first corresponding relationship are sent by the BNG module.
  • the first correspondence is generated by the BNG module according to the second correspondence between the source address and the user ID, and the user ID is used to indicate the user terminal.
  • the source address is the IP address assigned to the user terminal during the access authentication process, and the BNG module obtains the second corresponding relationship during the authentication access process.
  • the user terminal before the user terminal sends a message, it will subscribe to the SA policy. Since the user terminal is indicated by the user ID and the SA policy is indicated by the policy ID, a third correspondence between the user ID and the policy ID is formed. The third correspondence is stored in in the AAA server.
  • the BNG module sends the user ID to the AAA server, and the AAA server queries the third corresponding relationship according to the user ID, obtains the policy ID corresponding to the user ID, and returns the policy ID corresponding to the user ID to the BNG module, then the BNG module according to the policy ID corresponding to the user ID and The second correspondence generates the above-mentioned first correspondence, and then sends the first correspondence to the SA foreground module.
  • the broadband access device includes a BNG module and an SA foreground module, and for the manner in which the SA foreground module processes the first message in case 2, refer to the description in case 1. No more details are given here.
  • the SA policy used by the SA foreground module is sent by the SA background module
  • the first corresponding relationship used by the SA foreground module is sent by the BNG module or the SA background module.
  • the first correspondence is generated by the SA background module according to the second correspondence.
  • the authentication and authorization message sent by the BNG module to the AAA server during the access authentication process will also be copied to the SA background module, so the SA background module can obtain the above-mentioned second corresponding relationship through the authentication and authorization message.
  • the SA background module also stores the corresponding relationship between the SA policy and the policy ID.
  • the SA background module can send the user ID to the AAA server to obtain the policy ID corresponding to the user ID returned by the server based on the third corresponding relationship, so that according to the policy ID corresponding to the user ID and the second Correspondence
  • the SA background can send the policy ID to the AAA server, and the server can query the third corresponding relationship according to the policy ID, obtain the user ID corresponding to the policy ID, and return the user ID corresponding to the policy ID to the SA background module, and then the SA background module will correspond to the policy ID according to the policy ID.
  • the user ID and the second corresponding relationship generate the first corresponding relationship.
  • the SA background module can generate the first correspondence according to the second correspondence, so as to send the first correspondence to the SA foreground module.
  • the SA background module sends the SA policy to the SA foreground module, including: the SA foreground module sends a request message to the SA background module, and the request message includes the source address corresponding to the first user, that is, the source address of the first packet.
  • the SA background module queries the generated first correspondence according to the source address of the first message, obtains the policy ID corresponding to the source address, and returns the SA policy indicated by the policy ID to the SA front-end module. Therefore, the SA policy used by the SA foreground module can be sent by the SA background module.
  • the broadband access device includes a CP device and a UP device
  • the CP device includes an SA background module
  • the UP device includes an SA foreground module.
  • the UP device receives the first packet sent by the user terminal, and the SA foreground module included in the UP device obtains the first packet. After the SA foreground module determines that the first message belongs to the first user and belongs to the target service, it processes the first message according to the processing mode in the SA policy.
  • both the SA policy and the first corresponding relationship used by the SA foreground module are sent by the CP device to the UP device, and the SA foreground module included in the UP device can obtain the SA policy and the first corresponding relationship.
  • the process of obtaining the first correspondence by the CP device please refer to the process of obtaining the first correspondence by the BNG module in Case 1 above, and details will not be repeated here.
  • the SA foreground device receives the first message sent by the user terminal, and after the SA foreground device determines that the first message belongs to the first user and belongs to the target service, it follows the SA policy The processing manner in is to process the first packet.
  • both the SA policy used by the SA foreground device and the first corresponding relationship are sent by the CP device.
  • the process for the CP device to obtain the first correspondence refer to the process for the BNG module to obtain the first correspondence in Case 1 above, and details will not be repeated here.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the UP module receives the first packet sent by the user terminal, and forwards the first packet to the SA foreground module.
  • the SA foreground module determines that the first message belongs to the first user and belongs to the target service, it processes the first message according to the processing mode in the SA policy.
  • both the SA policy and the first corresponding relationship used by the SA foreground module are sent by the UP module, and the SA policy and the first corresponding relationship sent by the UP module are both from the CP module.
  • the CP module generates the first correspondence refer to the manner in which the BNG module generates the first correspondence in Case 1 above, and details are not repeated here.
  • the broadband access device includes a CP module, an UP module and an SA front-end module.
  • SA front-end module processes the first message in Case 6, refer to Case 5. , which will not be repeated here.
  • the SA policy used by the SA foreground module is sent by the SA background module.
  • the first corresponding relationship used by the SA foreground module is sent by the UP module or the SA background module, and the first corresponding relationship sent by the UP module comes from the CP module.
  • the method of generating the first correspondence by the CP module refer to the method of generating the first correspondence by the BNG module in case 1 above
  • the method of generating the first correspondence by the SA background module refer to the generation of the first correspondence by the SA background module in case 2 above. The way of the relationship will not be repeated here.
  • the SA front-end device receives the first packet sent by the user terminal, and after the SA front-end device determines that the first packet belongs to the first user and belongs to the target service, it follows the SA policy The processing manner in is to process the first packet.
  • both the SA policy used by the SA foreground device and the first corresponding relationship are sent by the SA background device.
  • the SA background device sends the SA policy to the SA foreground device refer to the description in the second case above, and will not be repeated here.
  • the SA background device generates the first correspondence refer to the manner in which the SA background module generates the first correspondence in the second case above, and details are not repeated here.
  • the method further includes: the SA foreground module (or SA foreground device) obtains statistical information (hereinafter referred to as second statistical information) of the traffic of the target service from the first user, to be consistent with the above description The first statistical information to distinguish).
  • the second statistical information includes but is not limited to: data volume, duration, time delay, etc., and this embodiment of the present application does not limit the second statistical information.
  • the second statistical information (such as data volume and duration) may be used for charging the traffic of the target service from the first user, and the second statistical information (such as time delay) may also be used for data analysis.
  • this embodiment of the present application further provides an SA identifier, so as to distinguish the above-mentioned first statistical information from the second statistical information.
  • the SA identifier is a TLV field.
  • the embodiment of the present application extends the RADIUS protocol, so that the RADIUS message carries the fifth TLV field, and the RADIUS message is a message using the RADIUS protocol.
  • the fifth TLV field see Table 5 below.
  • the length of the type field is, for example, 1-31 (excluding the terminator), the length of the length field is, for example, 3-33, and the value field carries the SA identifier.
  • the SA policy corresponds to policy charging information
  • the policy charging information is used to implement the charging process of the traffic of the target service of the first user.
  • the traffic of the target service of the first user is charged based on the policy charging information and the second statistical information.
  • the broadband access device includes a BNG module and an SA foreground module.
  • the SA foreground module obtains the second statistical information through statistics, and sends the second statistical information to the BNG module, and the BNG module performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the broadband access device includes a BNG module and an SA foreground module, the SA foreground module obtains the second statistical information through statistics, and sends the second statistical information to the SA background module, and the SA background The module performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the broadband access device includes a CP device and a UP device
  • the CP device includes an SA background module
  • the UP device includes an SA foreground module.
  • the SA foreground module collects the second statistical information, sends the second statistical information to the CP device through the UP device, and the CP device performs charging based on the second statistical information and the policy charging information corresponding to the SA policy.
  • the broadband access device includes a CP device, and the CP device includes an SA background module.
  • the SA foreground device collects the second statistical information, and sends the second statistical information to the CP device, and the CP device performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the SA foreground module obtains the second statistical information through statistics, and sends the second statistical information to the CP module through the UP module.
  • the CP module performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the broadband access device includes a CP module, an UP module and an SA foreground module.
  • the SA foreground module obtains the second statistical information through statistics, and sends the second statistical information to the SA background module through the UP module.
  • the SA background module performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the broadband access device includes an SA foreground device and a CP module
  • the SA foreground device includes an UP module
  • the CP module is located in the SA background device.
  • the SA foreground device collects the second statistical information, and sends the second statistical information to the SA background device, and the SA background device performs charging based on the second statistical information and policy charging information corresponding to the SA policy.
  • the traffic management method provided by the embodiment of the present application has been described above. Based on this method, the embodiment of the present application can provide various broadband services. It should be noted that the information that needs to be used in the following broadband services is all information obtained with the user's knowledge and consent. Please refer to the description below for various broadband services.
  • Poor quality analysis service Obtain statistical information on the traffic of the target service from the user.
  • the statistical information includes delay.
  • the poor quality users are obtained, and the communication experience is optimized for the poor quality users.
  • users with poor quality can also be graded, so that different optimization methods can be adopted for users with different levels of poor quality.
  • User portrait service Identify the target service that the user's message belongs to, and obtain the user portrait by analyzing the target service that the user prefers to access, so as to improve the user's communication experience based on the user portrait. For example, if the user profile is analyzed as follows: the user prefers game URLs, then the user's communication experience can be optimized on the game URLs.
  • Blocking service identify the target service that the user's message belongs to, and block the message according to actual needs. For example, if the target service to which the message belongs is forbidden to use, the message may be blocked. In this way, it is possible to avoid causing security problems or violating relevant regulations, thereby ensuring the user's communication experience.
  • Targeted business By obtaining the statistical information of the traffic of the user's target business, it is possible to determine the situation of the user's use of each target business in the process of surfing the Internet. In this way, an appropriate SA strategy can be recommended to the user according to the situation of the user using the target service, thereby improving the communication experience of the user. For example, in response to detecting that the user frequently uses the target URL, an SA policy related to the target URL may be recommended to the user, such as an SA policy for accelerating the target URL, thereby improving the communication experience of the user when using the target URL.
  • the AAA server can issue both authentication, authorization, and accounting information and SA policies.
  • the broadband access device In addition to obtaining authentication, authorization and accounting information, the broadband access device also obtains SA policies. Therefore, there is no need to separately set up two different servers in the network architecture, thereby simplifying the network architecture for traffic management, and realizing traffic management through a simple network architecture.
  • the SA capability can also be added to the broadband service.
  • the embodiment of the present application also provides a traffic management method, which is applied to an AAA server.
  • the AAA server may be the AAA server shown in FIG. 6-FIG.
  • the AAA server sends an SA policy to the target device, and the SA policy indicates a processing method for the traffic of the target service of the first user.
  • step 1401 refer to the description in steps 1301 and 1302 above, and details are not repeated here.
  • the embodiment of the present application also provides a traffic management method, which is applied to the SA background device, and the SA background device can be the SA background device shown in Figure 6- Figure 12 or the SA background device shown in Figure 6- Figure 12
  • the method includes step 1501 as follows.
  • Step 1501 the SA background device receives the SA policy sent by the AAA server, and the SA policy indicates the processing mode for the traffic of the target service of the first user.
  • step 1501 refer to the description in steps 1301 and 1302 above, and details are not repeated here.
  • the embodiment of the present application also provides a traffic management method, which is applied to a broadband access system, and the system includes a broadband access device, an AAA server, and an SA background device, wherein the broadband access device can be as shown in Figure 6-
  • the broadband access device shown in 12 the AAA server can be the AAA server shown in Figure 6- Figure 12
  • the SA background device can be the SA background device shown in Figure 6- Figure 12 or Figure 6- Figure 12
  • the method includes:
  • the AAA server sends the SA policy to the SA background device, and the SA policy indicates the processing method for the traffic of the target service of the first user;
  • the AAA server sends authentication, authorization and accounting information to the broadband access device, and the authentication, authorization and accounting information is used by the broadband access device to implement the access authentication process of the first user and the accounting process of the traffic of the first user.
  • the broadband access device is also used to perform the function of the SA foreground module, and the method further includes: the SA background device sends an SA policy to the broadband access device, and the broadband access device uses the SA policy to The traffic of a user's target service is processed.
  • the implementation of this application provides a traffic management method, the method is applied to a broadband access system, the system includes a broadband access device and an AAA server, and the method includes:
  • the AAA server sends authentication, authorization, and accounting information and an SA policy to the broadband access device, and the SA policy indicates a processing method for the traffic of the target service of the first user;
  • the broadband access device realizes the access authentication process of the first user and the charging process of the traffic of the first user according to the authentication authorization charging information
  • the broadband access device processes the traffic of the target service from the first user according to the SA policy, and the broadband access device is also used to execute the function of the SA foreground module.
  • the embodiment of the present application also provides a traffic management method, the method is applied to a broadband access system, and the system includes an SA background device and an AAA server, wherein the AAA server can be the AAA server shown in Figure 6- Figure 12, the Said SA background device can be the SA background device shown in Figure 6- Figure 12 or the device where the SA background module shown in Figure 6- Figure 12 is located, and the method includes:
  • the AAA server sends the authentication, authorization, and accounting information and the SA policy to the SA background device, and the SA policy indicates the processing method for the traffic of the target service of the first user;
  • the SA background device realizes the access authentication process of the first user and the billing process of the first user's flow according to the authentication authorization charging information, and the SA background device is used to execute the function of the CP module in the vBNG system;
  • the SA background device sends the SA policy to the SA foreground device, and the SA foreground device is used to execute the function of the UP module in the vBNG system.
  • the embodiment of the present application also provides the traffic management device shown in FIGS. 16 , 17 and 18 .
  • the traffic management apparatus shown in FIG. 16 is used to implement the method performed by the broadband access device in the method embodiment above through each module shown in FIG. 16 .
  • the traffic management device shown in FIG. 17 is used to execute the method executed by the AAA server in the method embodiment above through each module shown in FIG. 17 .
  • the apparatus shown in FIG. 18 is used to execute the method executed by the SA background device in the method embodiment above through each module shown in FIG. 18 .
  • Each flow management device will be described separately below.
  • an embodiment of the present application provides a traffic management device, which is applied to a broadband access device, and the device includes the following modules.
  • the receiving module 1601 is configured to receive the authentication, authorization, and accounting information and the SA policy sent by the AAA server, and the SA policy indicates the processing method for the traffic of the target service of the first user; the receiving module 1601 can be used to execute step 1301 shown in FIG. 13 .
  • An implementing module 1602 configured to implement the access authentication process of the first user and the accounting process of the traffic of the first user according to the authentication, authorization, and charging information.
  • the receiving module 1602 may be used to execute step 1302 shown in FIG. 13 .
  • the broadband access device is further configured to execute the function of the SA foreground module, and the device further includes: a processing module, configured to process the traffic of the target service from the first user according to the SA policy.
  • the receiving module 1601 is also configured to receive the first message
  • the device also includes: a determining module, configured to determine that the first message belongs to the first user; determine that the first message belongs to the target service;
  • the processing module is configured to process the first packet according to the processing manner in the SA policy based on the fact that the first packet belongs to the first user and belongs to the target service.
  • the determining module is configured to determine that the first packet belongs to the first user based on the source address of the first packet.
  • the device further includes: an obtaining module, configured to obtain statistical information of traffic of the target service from the first user.
  • the broadband access device is a vBNG system.
  • the vBNG system includes a CP device and a UP device.
  • the CP device is used to receive the SA policy sent by the server, and the UP device is used to execute the function of the SA foreground module.
  • the apparatus further includes: a first sending module, configured for the CP device to send the SA policy to the UP device through CUSP.
  • the broadband access device is a CP device in the vBNG system
  • the device further includes: a second sending module, used for the CP device to send the SA policy to the SA foreground device, and the SA foreground device is used to The traffic of the target service from the first user is processed.
  • the second sending module is configured for the CP device to send the SA policy to the SA foreground device through CUSP.
  • the SA policy is carried in the TLV field of the CUSP message.
  • the SA policy includes the corresponding relationship between the identification of the target service and the processing method, and the identification of the target service includes at least one of the following: application layer protocol identification, application layer protocol group identification, URL identification or URL group identification .
  • the receiving module 1601 is configured to receive the authentication, authorization and accounting information and the SA policy sent by the AAA server through the RADIUS protocol.
  • the receiving module 1601 is configured to receive the authentication, authorization and accounting information and the SA policy sent by the AAA server through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • an embodiment of the present application provides a traffic management device, which is applied to an AAA server, and the device includes the following modules.
  • the sending module 1701 is configured to send an SA policy to the target device, where the SA policy indicates a processing manner for the traffic of the target service of the first user.
  • the sending module 1701 may be used to execute step 1401 shown in FIG. 14 .
  • the target device is a broadband access device
  • the sending module 1701 is further configured to send authentication, authorization, and accounting information to the broadband access device.
  • the authentication, authorization, and accounting information is used by the broadband access device to implement the first The user's access authentication process and the first user's traffic billing process.
  • the broadband access device includes a CP device in the vBNG system.
  • the target device is an SA background device
  • the sending module 1701 is further configured to send authentication, authorization and charging information to the broadband access device, and the authentication, authorization and charging information is used by the broadband access device to implement the first user The access authentication process and the accounting process of the traffic of the first user.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • an embodiment of the present application provides a traffic management device, which is applied to an SA background device, and the device includes the following modules.
  • the receiving module 1801 is configured to receive the SA policy sent by the AAA server, the SA policy indicates the processing mode for the traffic of the target service of the first user.
  • the receiving module 1801 may be used to execute step 1501 shown in FIG. 15 .
  • the apparatus further includes: a sending module, configured to send the SA policy to the SA foreground device.
  • the sending module is configured to send the SA policy to the SA foreground device based on a request message sent by the SA foreground device, where the request message includes a source address corresponding to the first user.
  • the SA background device is used to perform the function of the CP module in the vBNG system
  • the SA foreground device is used to perform the function of the UP module in the vBNG system
  • the receiving module 1801 is also used to receive the
  • the authentication, authorization, and accounting information is used by the CP module and the UP module to implement the access authentication process of the first user and the accounting process of the traffic of the first user.
  • the sending module is configured to send the SA policy to the SA foreground device through CUSP.
  • the SA policy and authentication, authorization, and accounting information are sent through the RADIUS protocol.
  • the SA policy and the authentication, authorization and charging information are sent through the PCRF protocol.
  • the processing manner for the traffic of the target service of the first user includes performing at least one of the following processing on the traffic: bandwidth control, mirroring, or redirection.
  • the AAA server can issue both authentication, authorization, and accounting information and SA policies. Therefore, there is no need to separately set up two different servers in the network architecture, thereby simplifying the network architecture for traffic management, and realizing traffic management through a simple network architecture.
  • the embodiment of the present application provides a traffic management device, the device includes a memory and a processor; at least one instruction is stored in the memory, and at least one instruction is loaded and executed by the processor, so that the traffic management device realizes The flow management method shown in FIG. 13 , 14 or 15 above.
  • FIG. 19 shows a schematic structural diagram of an exemplary traffic management device 1900 of the present application, and the traffic management device 1900 includes at least one processor 1901 , a memory 1903 and at least one network interface 1904 .
  • the processor 1901 is, for example, a general-purpose CPU, a digital signal processor (digital signal processor, DSP), a network processor (network processor, NP), a GPU, a neural network processor (neural-network processing units, NPU), a data processing unit ( data processing unit, DPU), microprocessor or one or more integrated circuits or application-specific integrated circuits (application-specific integrated circuit, ASIC), programmable logic device (programmable logic device, PLD) or Other programmable logic devices, transistor logic devices, hardware components, or any combination thereof.
  • DSP digital signal processor
  • NP network processor
  • GPU a neural network processor
  • NPU neural-network processing units
  • NPU data processing unit
  • DPU data processing unit
  • microprocessor or one or more integrated circuits or application-specific integrated circuits application-specific integrated circuit, ASIC
  • programmable logic device programmable logic device, PLD
  • Other programmable logic devices transistor logic devices, hardware components, or any combination thereof.
  • the PLD is, for example, a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof. It can implement or execute the various logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor can also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and so on.
  • the traffic management device 1900 further includes a bus 1902 .
  • the bus 1902 is used to transfer information between the various components of the traffic management device 1900 .
  • the bus 1902 may be a peripheral component interconnect standard (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like.
  • PCI peripheral component interconnect standard
  • EISA extended industry standard architecture
  • the bus 1902 can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 19 , but it does not mean that there is only one bus or one type of bus.
  • the memory 1903 is, for example, a read-only memory (read-only memory, ROM) or other types of storage devices that can store static information and instructions, and is another example of a random access memory (random access memory, RAM) or other types that can store information and instructions.
  • types of dynamic storage devices such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by Any other medium accessed by a computer, but not limited to.
  • the memory 1903 exists independently, for example, and is connected to the processor 1901 through the bus 1902 .
  • the memory 1903 can also be integrated with the processor 1901.
  • the network interface 1904 uses any device such as a transceiver to communicate with other devices or a communication network.
  • the communication network can be Ethernet, radio access network (radio access network, RAN) or wireless local area network (wireless local area network, WLAN). )wait.
  • the network interface 1904 may include a wired network interface, and may also include a wireless network interface.
  • the network interface 1904 can be an Ethernet (Ethernet) interface, such as: fast Ethernet (fast Ethernet, FE) interface, Gigabit Ethernet (gigabit Ethernet, GE) interface, asynchronous transfer mode (asynchronous transfer mode, ATM) interface, WLAN interface, cellular network interface, or a combination thereof.
  • the Ethernet interface can be an optical interface, an electrical interface or a combination thereof.
  • the network interface 1904 may be used for the traffic management device 1900 to communicate with other devices.
  • the processor 1901 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 19 . Each of these processors can be a single-core processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the traffic management device 1900 may include multiple processors, such as the processor 1901 and the processor 1905 shown in FIG. 19 . Each of these processors can be a single-core processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.
  • the memory 1903 is used to store program instructions 1910 for implementing the solutions of the present application, and the processor 1901 can execute the program instructions 1910 stored in the memory 1903 . That is, the traffic management device 1900 may implement the method provided by the method embodiment shown in FIG. 13 , 14 or 15 through the processor 1901 and the program instructions 1910 in the memory 1903 . One or more software modules may be included in the program instructions 1910 . Optionally, the processor 1901 itself may also store program instructions for executing the solution of the present application.
  • the traffic management device 1900 of the present application may correspond to the first network element device for performing the above method, and the processor 1901 in the traffic management device 1900 reads the instructions in the memory 1903, so that the The traffic management device 1900 can perform all or part of the steps in the method embodiments.
  • the traffic management device 1900 may also correspond to the device shown in FIG. 16 , 17 or 18 above, and each functional module in the device shown in FIG. 16 , 17 or 18 is implemented by software of the traffic management device 1900 .
  • the functional modules included in the apparatus shown in FIG. 16 , 17 or 18 are generated after the processor 1901 of the traffic management device 1900 reads the program instructions 1910 stored in the memory 1903 .
  • each step of the method shown in FIG. 13 , 14 or 15 is completed by an integrated logic circuit of hardware in the processor of the traffic management device 1900 or instructions in the form of software.
  • the steps combined with the method embodiments disclosed in this application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method embodiments in combination with its hardware. To avoid repetition, no detailed description is given here.
  • processor may be a central processing unit (CPU), and may also be other general-purpose processors, digital signal processing (digital signal processing, DSP), application specific integrated circuit (application specific integrated circuit, ASIC), field-programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSP digital signal processing
  • ASIC application specific integrated circuit
  • FPGA field-programmable gate array
  • a general purpose processor may be a microprocessor or any conventional processor or the like. It should be noted that the processor may be a processor supporting advanced RISC machines (ARM) architecture.
  • ARM advanced RISC machines
  • the above-mentioned memory may include a read-only memory and a random-access memory, and provide instructions and data to the processor.
  • Memory may also include non-volatile random access memory.
  • the memory may also store device type information.
  • the memory can be either volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available.
  • static random access memory static random access memory
  • dynamic random access memory dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access Memory double data date SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous link dynamic random access memory direct memory bus random access memory (direct rambus) RAM, DR RAM).
  • the embodiment of the present application provides a computer program (product), the computer program (product) including: computer program code, when the computer program code is run by the computer, the computer is made to execute the above-mentioned Figure 13, 14 or 15 shows the flow management method.
  • the embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores programs or instructions.
  • the programs or instructions are run on the computer, the above-mentioned FIG. 13 , 14 or 15
  • the traffic management method is implemented.
  • the embodiment of the present application provides a chip, including a processor, configured to call and execute instructions stored in the memory from the memory, so that the communication device installed with the chip executes the above-mentioned Figure 13, 14 or 15 Flow management method shown.
  • the embodiment of the present application provides another chip, including: an input interface, an output interface, a processor, and a memory.
  • the input interface, the output interface, the processor, and the memory are connected through an internal connection path, and the processor uses The code in the memory is executed, and when the code is executed, the processor is used to execute the traffic management method shown in FIG. 13 , 14 or 15 above.
  • the implementation of the present application provides a network system, the system includes a broadband access device, an AAA server and an SA background device, and the broadband access device is used to execute the traffic management method shown in Figure 13 above,
  • the AAA server is used to execute the traffic management method shown in FIG. 14
  • the SA background device is used to execute the traffic management method shown in FIG. 15 .
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, DSL) or wireless (eg, infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk).
  • first and second are used to distinguish the same or similar items with basically the same function and function. It should be understood that “first”, “second” and “nth” There are no logical or timing dependencies, nor are there restrictions on quantity or order of execution. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.
  • if and “if” may be construed to mean “when” ("when” or “upon”) or “in response to determining” or “in response to detecting”.
  • phrases “if it is determined" or “if [the stated condition or event] is detected” may be construed to mean “when determining” or “in response to determining... ” or “on detection of [stated condition or event]” or “in response to detection of [stated condition or event]”.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

流量管理方法、装置、设备及计算机可读存储介质，属于通信技术领域。其中，应用于宽带接入设备的方法包括：宽带接入设备接收AAA服务器发送的认证授权计费信息和SA策略，该SA策略用于指示针对第一用户的目标业务的流量的处理方式（1301）。之后，宽带接入设备根据认证授权计费信息实现第一用户的接入认证过程，且实现第一用户的流量的计费过程（1302）。该方法简化了用于进行业务感知的流量管理的网络架构，通过简洁的网络架构实现了业务感知的流量管理。

Description

流量管理方法、装置、设备及计算机可读存储介质
本申请要求于2021年07月31日提交的申请号为202110876943.0、发明名称为“一种宽带网络网关系统”的中国专利申请的优先权，本申请还要求于2021年12月03日提交的申请号为202111467664.5、发明名称为“流量管理方法、装置、设备及计算机可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及流量管理方法、装置、设备及计算机可读存储介质。
背景技术
随着通信技术的发展，用于进行流量管理的网络架构也越来越复杂。如何对网络架构进行简化，或者说，如何通过简洁的网络架构实现流量管理，成为亟待解决的问题。
发明内容
本申请提供了一种流量管理方法、装置、设备及计算机可读存储介质，以通过简洁的网络架构实现流量管理，技术方案如下。
第一方面，提供了一种流量管理方法，该方法应用于宽带接入设备，方法包括：
宽带接入设备接收认证授权计费(authentication authorization accounting，AAA)服务器发送的认证授权计费信息和业务感知(service aware，SA)策略，该SA策略用于指示针对第一用户的目标业务的流量的处理方式。之后，宽带接入设备根据认证授权计费信息实现第一用户的接入认证过程，且实现第一用户的流量的计费过程。
本申请中AAA服务器既可以下发认证授权计费信息，又可以下发SA策略。宽带接入设备除了获取认证授权计费信息以外，还获取SA策略。因此，无需在网络架构中分别设置两个不同的服务器，从而简化了用于进行业务感知的流量管理的网络架构，通过简洁的网络架构实现了业务感知的流量管理。
在一种可能的实现方式中，宽带接入设备还用于执行SA前台模块的功能，方法还包括：宽带接入设备根据SA策略对来自于第一用户的目标业务的流量进行处理。通过根据SA策略处理流量，在宽带业务中实现了SA能力，提高了宽带业务的质量和第一用户的通信体验。此时，宽带接入设备可以是一台宽带接入设备，例如传统宽带网络网关(broadband network gateway，BNG)设备，也可以是宽带远程接入服务器(Broadband Remote Access Server，BRAS)，也可以是虚拟宽带网络网关(virtual broadband network gateway，vBNG)系统。宽带接入设备还集成有SA前台模块，以执行SA前台模块的功能。
在一种可能的实现方式中，方法还包括：宽带接入设备接收第一报文，宽带接入设备确定第一报文属于第一用户，宽带接入设备确定第一报文属于目标业务；
宽带接入设备根据SA策略对来自于第一用户的目标业务的流量进行处理，包括：基于第一报文属于第一用户且属于目标业务，宽带接入设备按照SA策略中的处理方式对第一报 文进行处理。
在一种可能的实现方式中，宽带接入设备确定第一报文属于第一用户，包括：宽带接入设备基于第一报文的源地址确定第一报文属于第一用户。该确定方式较为灵活简便。
在一种可能的实现方式中，方法还包括：宽带接入设备获得来自于第一用户的目标业务的流量的统计信息。其中，统计信息可以发送至SA后台设备，统计信息可以用于计费过程，也可以用于数据分析等其他过程。
在一种可能的实现方式中，宽带接入设备为vBNG系统，vBNG系统包括控制面(control plane，CP)设备和用户面(user plane，UP)设备，CP设备用于接收AAA服务器发送的SA策略，UP设备用于执行SA前台模块的功能。此时，CP设备用于执行SA后台模块的功能，AAA服务器下发的SA策略首先发送至vBNG系统中的CP设备，再由CP设备传递至UP设备。从而，该方法可以与用户面与控制面分离(control user plane separation，CU分离)的vBNG系统相结合。
在一种可能的实现方式中，方法还包括：CP设备通过控制面与用户面分离协议(control plane user plane separated protocol，CUSP)向UP设备发送SA策略。
在一种可能的实现方式中，宽带接入设备为vBNG系统中的CP设备，方法还包括：CP设备向SA前台设备发送SA策略，SA前台设备用于根据SA策略对来自于第一用户的目标业务的流量进行处理。此时，CP设备与SA后台设备可以为相互独立的设备，SA后台设备可以执行除了向SA前台下发SA策略以外的其他相关功能，例如，SA后台设备接收SA前台设备发送的目标业务的统计信息。
在一种可能的实现方式中，CP设备向SA前台设备发送SA策略，包括：CP设备通过CUSP向SA前台设备发送SA策略。
在一种可能的实现方式中，SA策略携带在CUSP报文的类型长度值(type length value，TLV)字段中。通过对CUSP进行扩展，使得CUSP能够携带SA策略。
在一种可能的实现方式中，SA策略包括目标业务的标识与处理方式的对应关系，其中，目标业务的标识包括以下至少一种：应用层协议标识、应用层协议组标识、统一资源定位符(uniform resource locator，URL)标识或URL组标识。
在一种可能的实现方式中，宽带接入设备接收AAA服务器发送的认证授权计费信息和SA策略，包括：宽带接入设备通过远程身份验证拨号用户服务(remote authentication dial in user service，RADIUS)协议接收AAA服务器发送的认证授权计费信息和SA策略。AAA服务器可以是RADIUS服务器。例如，RADIUS服务器可以通过扩展的RADIUS协议下发SA策略，SA策略包括在扩展的TLV字段中。
在一种可能的实现方式中，宽带接入设备接收AAA服务器发送的认证授权计费信息和SA策略，包括：宽带接入设备通过策略与计费规则功能(policy and charging rules function，PCRF)协议接收AAA服务器发送的认证授权计费信息和SA策略。AAA服务器可以是PCRF服务器。例如，PCRF服务器可以通过扩展的PCRF协议下发SA策略，SA策略包括在扩展的TLV字段中。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
第二方面，提供了一种流量管理方法，方法应用于AAA服务器，方法包括：
AAA服务器向目标设备发送SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
本申请中AAA服务器还可以下发SA策略。因此，无需在网络架构中分别设置两个不同的服务器，从而简化了用于进行业务感知的流量管理的网络架构，通过简洁的网络架构实现了业务感知的流量管理。
在一种可能的实现方式中，目标设备为宽带接入设备，方法还包括：AAA服务器向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。此时，宽带接入设备除了获取认证授权计费信息以外，还获取SA策略信息。此时，宽带接入设备可以是一台宽带接入设备，例如传统BNG设备，也可以是vBNG系统。
在一种可能的实现方式中，宽带接入设备包括vBNG系统中的CP设备。此时，CP设备可以进一步将SA设备传递给UP设备，UP设备用于执行SA前台模块的功能。
在一种可能的实现方式中，目标设备为SA后台设备，方法还包括：AAA服务器向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。此时，SA后台设备与宽带接入设备可以为相互独立的设备，AAA服务器分别向SA后台和宽带接入设备发送SA策略和认证授权计费信息。此时，宽带接入设备可以是一台宽带接入设备，例如传统BNG设备，也可以是vBNG系统。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
第三方面，提供了一种流量管理方法，方法应用于SA后台设备，方法包括：
SA后台设备接收AAA服务器发送的SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
本申请中SA后台设备从AAA服务器接收SA策略，AAA服务器既可以下发认证授权计费信息，又可以下发SA策略。因此，无需在网络架构中分别设置两个不同的服务器，从而简化了用于进行业务感知的流量管理的网络架构，通过简洁的网络架构实现了业务感知的流量管理。
在一种可能的实现方式中，方法还包括：SA后台设备向SA前台设备发送SA策略。
在一种可能的实现方式中，SA后台设备向SA前台设备发送SA策略，包括：基于SA前台设备发送的请求消息，SA后台设备向SA前台设备发送SA策略，请求消息包括第一用户对应的源地址。此时，SA前台设备基于源地址请求该源地址对应的第一用户的SA策略，以用于对来自于第一用户的目标业务的流量进行处理。
在一种可能的实现方式中，SA后台设备用于执行vBNG系统中的CP模块的功能，SA前台设备用于执行vBNG系统中的UP模块的功能，方法还包括：SA后台设备接收AAA服务器发送的认证授权计费信息，认证授权计费信息用于CP模块和UP模块实现第一用户的接入认证过程以及第一用户的流量的计费过程。此时，CP设备用于执行SA后台模块的功能，从而，该方法可以与CU分离的vBNG系统相结合。
在一种可能的实现方式中，SA后台设备向SA前台设备发送SA策略，包括：SA后台设 备通过CUSP向SA前台设备发送SA策略。此时，AAA服务器下发的SA策略首先发送至vBNG系统中的CP设备，再由CP设备通过扩展的CUSP传递至UP设备。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
第四方面，提供了一种流量管理装置，装置应用于宽带接入设备，装置包括：
接收模块，用于接收AAA服务器发送的认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
实现模块，用于根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，宽带接入设备还用于执行SA前台模块的功能，装置还包括：处理模块，用于根据SA策略对来自于第一用户的目标业务的流量进行处理。
在一种可能的实现方式中，接收模块，还用于接收第一报文；
装置还包括：确定模块，用于确定第一报文属于第一用户；确定第一报文属于目标业务；
处理模块用于基于第一报文属于第一用户且属于目标业务，按照SA策略中的处理方式对第一报文进行处理。
在一种可能的实现方式中，确定模块，用于基于第一报文的源地址确定第一报文属于第一用户。
在一种可能的实现方式中，装置还包括：获得模块，用于获得来自于第一用户的目标业务的流量的统计信息。
在一种可能的实现方式中，宽带接入设备为vBNG系统，vBNG系统包括CP设备和UP设备，CP设备用于接收AAA服务器发送的SA策略，UP设备用于执行SA前台模块的功能。
在一种可能的实现方式中，装置还包括：第一发送模块，用于CP设备通过CUSP向UP设备发送SA策略。
在一种可能的实现方式中，宽带接入设备为vBNG系统中的CP设备，装置还包括：第二发送模块，用于CP设备向SA前台设备发送SA策略，SA前台设备用于根据SA策略对来自于第一用户的目标业务的流量进行处理。
在一种可能的实现方式中，第二发送模块，用于CP设备通过CUSP向SA前台设备发送SA策略。
在一种可能的实现方式中，SA策略携带在CUSP报文的TLV字段中。
在一种可能的实现方式中，SA策略包括目标业务的标识与处理方式的对应关系，其中，目标业务的标识包括以下至少一种：应用层协议标识、应用层协议组标识、URL标识或URL组标识。
在一种可能的实现方式中，接收模块，用于通过RADIUS协议接收AAA服务器发送的认证授权计费信息和SA策略。
在一种可能的实现方式中，接收模块，用于通过PCRF协议接收AAA服务器发送的认证授权计费信息和SA策略。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行 以下至少一种处理：带宽控制、镜像或重定向。
第五方面，提供了一种流量管理装置，流量管理装置应用于AAA服务器，装置包括：
发送模块，用于向目标设备发送SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
在一种可能的实现方式中，目标设备为宽带接入设备，发送模块，还用于向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，宽带接入设备包括vBNG系统中的CP设备。
在一种可能的实现方式中，目标设备为SA后台设备，发送模块，还用于向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
第六方面，提供了一种流量管理装置，装置应用于SA后台设备，装置包括：
接收模块，用于接收AAA服务器发送的SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
在一种可能的实现方式中，装置还包括：发送模块，用于向SA前台设备发送SA策略。
在一种可能的实现方式中，发送模块，用于基于SA前台设备发送的请求消息，向SA前台设备发送SA策略，请求消息包括第一用户对应的源地址。
在一种可能的实现方式中，SA后台设备用于执行vBNG系统中的CP模块的功能，SA前台设备用于执行vBNG系统中的UP模块的功能，接收模块，还用于接收AAA服务器发送的认证授权计费信息，认证授权计费信息用于CP模块和UP模块实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，发送模块，用于通过CUSP向SA前台设备发送SA策略。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
第七方面，提供了一种宽带接入系统，该系统包括宽带接入设备、AAA服务器和SA后台设备，其中，
AAA服务器用于向SA后台设备发送SA策略，该SA策略指示针对第一用户的目标业务的流量的处理方式，以及向宽带接入设备发送认证授权计费信息，该认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，宽带接入设备还用于执行SA前台模块的功能，SA后台设备用于向宽带接入设备发送SA策略；宽带接入设备用于根据SA策略对来自于第一用户的目标业务的流量进行处理。
第八方面，提供了一种宽带接入系统，该系统包括宽带接入设备和AAA服务器，其中，
AAA服务器用于向宽带接入设备发送认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
宽带接入设备用于根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程；并且根据SA策略对来自于第一用户的目标业务的流量进行处理。
第九方面，提供了一种宽带接入系统，该系统包括SA后台设备和AAA服务器，其中，
AAA服务器用于向SA后台设备发送认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
SA后台设备用于根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程，SA后台设备用于执行vBNG系统中的CP模块的功能；以及向SA前台设备发送SA策略，SA前台设备用于执行vBNG系统中的UP模块的功能。
第十方面，提供了一种流量管理设备，设备包括存储器及处理器；存储器中存储有至少一条指令，至少一条指令由处理器加载并执行，以使流量管理设备实现上述第一方面和第一方面的任一种可能的实现方式中的方法。
第十一方面，提供了一种流量管理设备，设备包括存储器及处理器；存储器中存储有至少一条指令，至少一条指令由处理器加载并执行，以使流量管理设备实现上述第二方面和第二方面的任一种可能的实现方式中的方法。
第十二方面，提供了一种流量管理设备，设备包括存储器及处理器；存储器中存储有至少一条指令，至少一条指令由处理器加载并执行，以使流量管理设备实现上述第三方面和第三方面的任一种可能的实现方式中的方法。
可选地，处理器为一个或多个，存储器为一个或多个。
可选地，存储器可以与处理器集成在一起，或者存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请对存储器的类型以及存储器与处理器的设置方式不做限定。
第十三方面，提供了一种计算机程序(产品)，计算机程序(产品)包括：计算机程序代码，当计算机程序代码被计算机运行时，使得计算机执行上述各方面中的方法。
第十四方面，提供了一种计算机可读存储介质，计算机可读存储介质存储程序或指令，当程序或指令在计算机上运行时，上述各方面中的方法被执行。
第十五方面，提供了一种芯片，包括处理器，用于从存储器中调用并运行存储器中存储的指令，使得安装有芯片的通信设备执行上述各方面中的方法。
第十六方面，提供另一种芯片，包括：输入接口、输出接口、处理器和存储器，输入接口、输出接口、处理器以及存储器之间通过内部连接通路相连，处理器用于执行存储器中的代码，当代码被执行时，处理器用于执行上述各方面中的方法。
第十七方面，提供了一种网络系统，该系统包括宽带接入设备、AAA服务器和SA后台设备，宽带接入设备用于执行上述第一方面和第一方面的任一种可能的实现方式中的方法，AAA服务器用于执行上述第二方面和第二方面的任一种可能的实现方式中的方法，SA后台设备用于执行上述第三方面和第三方面的任一种可能的实现方式中的方法。
附图说明
图1为本申请实施例提供的一种多层协议的示意图；
图2为本申请实施例提供的一种相关技术中实现SA能力的示意图；
图3为本申请实施例提供的一种SA前台模块和SA后台模块的结构示意图；
图4为本申请实施例提供的一种实施环境的结构示意图；
图5为本申请实施例提供的一种流量管理系统的结构示意图；
图6为本申请实施例提供的一种流量管理系统的结构示意图；
图7为本申请实施例提供的一种流量管理系统的结构示意图；
图8为本申请实施例提供的一种流量管理系统的结构示意图；
图9为本申请实施例提供的一种流量管理系统的结构示意图；
图10为本申请实施例提供的一种流量管理系统的结构示意图；
图11为本申请实施例提供的一种流量管理系统的结构示意图；
图12为本申请实施例提供的一种流量管理系统的结构示意图；
图13为本申请实施例提供的一种流量管理方法的流程示意图；
图14为本申请实施例提供的一种流量管理方法的流程示意图；
图15为本申请实施例提供的一种流量管理方法的流程示意图；
图16为本申请实施例提供的一种流量管理装置的结构示意图；
图17为本申请实施例提供的一种流量管理装置的结构示意图；
图18为本申请实施例提供的一种流量管理装置的结构示意图；
图19为本申请实施例提供的一种流量管理设备的结构示意图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
随着通信技术的发展，人们对于宽带业务的要求也越来越高，宽带业务包括但不限于固定宽带(fixed broadband，FBB)。其中，宽带业务属于流量管理的其中一种方式，通过简洁的网络架构提供宽带业务，也即是通过简洁的网络架构实现了流量管理。
目前，在宽带业务中增加SA能力成为研究热点。SA能力包括深度报文解析(deep packet inspection，DPI)能力，SA能力是指识别用户的流量所属的业务，并基于所属的业务对流量进行处理的能力。其中，所属的业务包括但不限于某个URL、某个URL组或者某个应用程序(Application，APP)、某个APP组。需要说明的是，SA能力依赖于设备对第五层(layer 5，L5)至第七层(layer 7，L7)协议的识别能力。由于提供宽带业务的网络架构包括的设备仅具备对第二层(layer 2，L2)至第四层(layer 4，L4)协议的识别能力，例如具备对第三层(layer 3，L3)协议的识别能力，因而提供宽带业务的网络架构不具备SA能力。其中，上述各层协议可参见图1。图1中，L2协议包括介质访问控制(medium access control，MAC)协议，L3协议包括互联网协议(Internet protocol，IP)，L4协议包括传输控制协议(transmission control protocol，TCP)或用户数据包协议(user datagram protocol，UDP)，L5-L7协议包括超文本传输协议(hyper text transfer protocol，HTTP)。
在相关技术中，以用于提供宽带业务的网络架构包括的设备为基础，增加SA前台模块和SA后台模块。并且，部署一个独立的服务器，通过该独立的服务器下发SA策略，SA前 台模块和SA后台模块基于SA策略实现SA能力。此外，相关技术还需要部署另一个独立的服务器，以向用于提供宽带业务的网络架构包括的设备下发认证授权计费信息。参见图2，相关技术中将SA前台模块集成在BNG中，形成BNG/SA前台，并结合SA后台、服务器A和服务器B(服务器A和服务器B为两个不同的服务器)，通过图2所示的步骤实现SA能力。
201，服务器A向SA后台发送SA策略，形成用户标识(identification，ID)与SA策略的对应关系。
202，用户终端向BNG/SA前台发送上线请求。
203，BNG/SA前台向服务器B发送认证授权报文，实现用户终端的认证授权。
204，BNG/SA前台向SA后台抄送认证授权报文，认证授权报文携带IP地址和用户ID。
205，SA后台根据认证授权报文生成IP地址和用户ID的对应关系。
206，用户终端的流量到达BNG/SA前台，BNG将流量引流至SA前台，SA前台抽取流量的IP地址。
207，SA前台使用流量的IP地址向SA后台请求SA策略。
208，SA后台基于IP地址，依次查找IP地址和用户ID的对应关系，以及，用户ID与SA策略的对应关系，得到SA策略。
209，SA后台下发SA策略。
210，SA前台执行SA策略，按照SA策略对流量进行处理。
211，SA前台统计流量的相关信息，上报至SA后台进行计费。
基于上述图2所示的过程可以看出，虽然能够在宽带业务中增加SA能力，但需要部署两个不同的服务器，不仅成本较高，而且使得网络架构较为复杂。
参见图3，图3示出了SA前台模块和SA后台模块的结构示意图。其中，SA前台模块与SA后台模块连接，SA前台模块包括业务感知功能(service aware function，SAF)单元，SA后台模块包括数据分析功能(data analysis function，DAF)单元和策略控制功能(policy control function，PCF)单元。其中，SAF单元、DAF单元和PCF单元的功能如下。
SAF单元，用于根据PCF单元下发的SA策略和特征库，识别用户的流量所属的业务，基于所属的业务，按照SA策略对用户的流量进行处理，统计用户的流量相关的信息并上报至DAF单元。
DAF单元，用于接收SAF单元统计的信息并进行存储(例如存储于数据库中)，基于接收的信息和PCF单元下发的SA策略进行数据分析(例如计费)，得到数据分析结果，根据分析结果通知PCF单元更新向SAF单元下发的SA策略，将数据分析结果以报表形式呈现(例如呈现给运营商)。
PCF单元，用于提供人机交互界面和运营商对接接口，支持SA策略的生成和特征库的生成，向SAF单元和DAF单元下发SA策略，向SAF单元下发特征库。
针对上文相关技术中存在的问题，本申请实施例提供了一种流量管理方法，该方法可以应用于提供宽带业务的网络架构中，该网络架构用于用户终端接入目的网络。或者说，该网络架构可以将用户的流量传输至目的网络，使得用户可以使用用户终端上网。示例性地，目的网络包括但不限于因特网(internet)，本申请实施例不对目的网络加以限定。以该网络架构如图4所示的实施环境为例，如图4所示，用户终端、家庭网关(residential gateway，RG)、光网络终端(optical network terminal，ONT)、光线路终端(optical line terminal，OLT)、流 量管理系统、固定网络和目的网络依次连接。示例性地，固定网络包括但不限于以下网络中的至少一种：加速通道网络和公众互联骨干网。用户终端通过RG、ONT和OLT等接入固定网络，再由固定网络接入目的网络。在由固定网络接入目的网络前，流量管理系统可对用户的流量进行管理。
示例性地，流量管理系统可以包括多个设备，多个设备中的第一设备分别与OLT和固定网络直连，而多个设备中的第二设备与第一设备连接。其中，第一设备包括多个设备中的至少一个设备，第二设备包括多个设备中除第一设备之外的其他设备。由此，使得第一设备位于用户的流量的传输路径上，而第二设备旁挂。关于第一设备和第二设备的类型，可参见后续图6-图12的描述。
在示例性实施例中，参见图5，流量管理系统包括宽带接入设备和AAA服务器，宽带接入设备和AAA服务器连接。
示例性地，宽带接入设备可以包括宽带网络网关(BNG)，又称为宽带远程接入服务器。在一种可能的实现方式中，宽带接入设备包括BNG模块，BNG模块可以通过路由器、交换机等转发设备实现。流量管理系统还可以包括SA后台模块，示例性地，SA后台模块可以通过计算机设备，例如服务器设备实现。
示例性地，宽带接入设备还包括SA前台模块。示例性地，SA前台模块可以通过插卡实现，该插卡可以插装于路由器、交换机等转发设备。
基于以上说明，本申请实施例提供如下几种类型的流量管理系统。
类型一，参见图6，流量管理系统包括宽带接入设备和AAA服务器，流量管理系统还包括SA后台模块。宽带接入设备包括BNG模块和SA前台模块。AAA服务器、BNG模块、SA前台模块和SA后台模块依次连接。
将图6所示的流量管理系统应用于图4所示的网络架构，用户终端、RG、ONT和OLT、宽带接入设备、固定网络和目的网络依次连接。AAA服务器和SA后台模块分别与宽带接入设备连接。也就是说，宽带接入设备位于用户的流量的传输路径上，AAA服务器和SA后台模块旁挂。
示例性地，SA后台模块和SA前台模块之前通过私有接口连接。在一种可能的实现方式中，BNG模块和SA前台模块的功能可由BNG设备实现。示例性地，SA后台模块可以位于宽带接入设备以外的其他设备上。例如，SA后台模块的功能可由SA后台设备实现。
类型二，参见图7，在图6所示的类型一的基础上，SA后台模块还与AAA服务器连接。
类型三，如图8所示，流量管理系统包括宽带接入设备和AAA服务器，宽带接入设备为vBNG系统，vBNG系统包括CP设备和UP设备。AAA服务器、CP设备和UP设备依次连接。其中，上文说明中宽带接入设备包括的BNG模块体现为CP设备和UP设备。CP设备包括SA后台模块，UP设备包括SA前台模块。
将图8所示的流量管理系统应用于图4所示的网络架构，用户终端、RG、ONT、OLT、包括SA前台模块的UP设备、固定网络和目的网络依次连接。包括SA后台模块的CP设备与包括SA前台模块的UP设备连接，AAA服务器与包括SA后台模块的CP设备连接。也就是说，包括SA前台模块的UP设备位于用户的流量的传输路径上，包括SA后台模块的CP设备和AAA服务器旁挂。
类型四，参见图9，流量管理系统包括宽带接入设备和AAA服务器，宽带接入设备为 vBNG系统中的CP设备。vBNG系统中的CP设备包括SA后台模块。流量管理系统还包括SA前台设备，该SA前台设备实现SA前台模块的功能。AAA服务器、包括SA后台模块的CP设备和SA前台设备依次连接。
将图9所示的流量管理系统应用于图4所示的网络架构，用户终端、RG、ONT、OLT、SA前台设备、固定网络和目的网络依次连接。其中，包括SA后台模块的CP设备与SA前台设备连接，AAA服务器与包括SA后台模块的CP设备连接。也就是说，SA前台设备位于用户的流量的传输路径上，包括SA后台模块的CP设备和AAA服务器旁挂。
或者，在示例性实施例中，流量管理系统中，vBNG系统中的CP设备可以不包括SA后台模块，即SA后台模块位于CP设备以外的其他设备中。例如，参见如下类型五和类型六的描述。
类型五，如图10所示，流量管理系统包括宽带接入设备和AAA服务器，流量管理系统还包括SA后台模块。宽带接入设备包括CP模块、UP模块和SA前台模块。AAA服务器、CP模块、UP模块、SA前台模块和SA后台模块依次连接。
将图10所示的流量管理系统应用于图4所示的网络架构，用户终端、RG、ONT、OLT、宽带接入设备、固定网络和目的网络依次连接。AAA服务器和SA后台模块分别与宽带接入设备连接。也就是说，宽带接入设备位于用户的流量的传输路径上，AAA服务器和SA后台模块旁挂。
示例性地，CP模块的功能可由CP设备实现，UP模块和SA前台的功能可由UP设备实现。可选地，SA后台模块的功能可由SA后台设备实现，SA后台设备与SA前台模块通过私有接口连接。
类型六，参见图11，在图10所示的类型五的基础上，SA后台模块还与AAA服务器连接。
类型七，如图12所示，流量管理系统包括宽带接入设备和AAA服务器，宽带接入设备包括SA前台设备和SA后台设备，SA前台设备实现UP模块的功能，SA后台设备实现CP模块的功能。AAA服务器、包括CP模块的SA后台设备和包括UP模块的SA前台设备依次连接。
将图12所示的流量管理系统应用于图4所示的网络架构，用户终端、RG、ONT、OLT、包括UP模块的SA前台设备、固定网络和目的网络依次连接。包括CP模块的SA后台设备与包括UP模块的SA前台设备连接，AAA服务器与包括CP模块的SA后台设备连接。也就是说，包括UP模块的SA前台设备位于用户的流量的传输路径上，包括CP模块的SA后台设备和AAA服务器旁挂。
本申请实施例提供了一种流量管理方法，该方法应用于上述各个类型的流量管理系统包括的宽带接入设备中。如图13所示，该方法包括如下的步骤1301和1302。
1301，宽带接入设备接收AAA服务器发送的认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
其中，认证授权计费信息包括认证授权信息和计费信息，认证授权信息用于实现第一用户的接入认证过程，计费信息用于实现第一用户的流量的计费过程。其中，第一用户的流量的计费过程包括：针对第一用户的流量的计费过程。例如，上述针对第一用户的流量的计费 过程可以不区分流量所属的业务。
通过情况一至情况七对各个类型的流量管理系统接收认证授权计费信息和SA策略的方式进行说明。
对应于类型一的流量管理系统的情况一，参见图6，宽带接入设备包括BNG模块和SA前台模块。BNG模块从AAA服务器接收认证授权计费信息和SA策略。BNG模块向SA前台模块发送该SA策略。
对应于类型二的流量管理系统的情况二，参见图7，宽带接入设备包括BNG模块和SA前台模块。BNG模块从AAA服务器接收认证授权计费信息，SA后台模块从AAA服务器接收SA策略，SA后台模块向SA前台模块发送SA策略。
对应于类型三的流量管理系统的情况三，参见图8，宽带接入设备包括CP设备和UP设备，CP设备包括SA后台模块，UP设备包括SA前台模块。CP设备从AAA服务器接收认证授权计费信息和SA策略，CP设备向UP设备发送SA策略，以使得UP设备包括的SA前台模块获得SA策略。
对应于类型四的流量管理系统的情况四，参见图9，宽带接入设备包括CP设备，CP设备包括SA后台模块。CP设备从AAA服务器接收认证授权计费信息和SA策略，CP设备向SA前台设备发送SA策略。
对应于类型五的流量管理系统的情况五，参见图10，宽带接入设备包括CP模块、UP模块和SA前台模块。CP模块从AAA服务器接收认证授权计费信息和SA策略，CP模块向UP模块发送SA策略，UP模块向SA前台模块发送SA策略。
对应于类型六的流量管理系统的情况六，参见图11，宽带接入设备包括CP模块、UP模块和SA前台模块。CP模块从AAA服务器接收认证授权计费信息，SA后台模块从AAA服务器接收SA策略，SA后台模块向SA前台模块发送SA策略。
对应于类型七的流量管理系统的情况七，参见图12，宽带接入设备包括包括SA前台设备和SA后台设备，SA前台设备包括UP模块，SA后台设备包括CP模块。SA后台设备从AAA服务器接收认证授权计费信息和SA策略，SA后台设备包括的CP模块得到认证授权计费信息，SA后台设备向SA前台设备发送SA策略。
在上述情况三、四、五和七中，SA策略可以通过CUSP被发送。例如，可以在扩展的CUSP协议中增加TLV字段，SA策略携带在该新增加的TLV字段中。
示例性地，SA策略包括目标业务的标识与处理方式的对应关系，目标业务的标识包括以下至少一种：应用层协议标识、应用层协议组标识、URL标识或URL组标识，本申请实施例不对目标业务的标识加以限定。其中，所述处理方式可以包括处理动作。
示例性地，处理方式包括但不限于阻断(block)、镜像(mirror)、带宽控制和重定向中的至少一个，本实施例不对处理方式加以限定。其中，阻断是指终止流量的传输过程。镜像是指对流量进行复制，原流量进行正常传输，而复制得到的流量用于进行数据分析。带宽控制是指确定用于传输流量的网络，例如流量需要较大的带宽则采用加速通道网络传输流量，流量无需较大的带宽则采用公众互联骨干网传输流量，通过带宽控制过程能够控制流量传输速率。重定向是指改变流量的路由信息，通过不同负载的设备对流量进行传输，从而能够控制流量的传输速率。
基于SA策略所包括的内容，本申请实施例需要对CUSP进行扩展，以使得CP设备能够 通过CUSP发送SA策略。在示例性实施例中，SA策略携带在CUSP报文的TLV字段中，CUSP报文为使用CUSP的报文。示例性地，TLV字段包括第一TLV字段，第一TLV字段携带URL组标识和/或协议组标识，其中，所述URL组标识和/或协议组标识用于标识该SA策略针对的目标业务，第一TLV字段参见如下的表1。
表1
类型 长度 值
列表(list) 不限 URL组标识列表(URL group ID list)
列表 不限 协议组标识列表(protocol group ID list)
在表2中，URL组标识列表包括至少一个URL组标识，一个URL组标识用于唯一指示一个URL组，一个URL组中包括至少一个URL。协议组标识列表包括至少一个协议组标识，一个协议组标识用于唯一指示一个协议组，一个协议组中包括至少一个协议。
另外，TLV字段还包括第二TLV字段和/或第三TLV字段，第二TLV字段携带URL组标识和URL组标识对应的处理方式，第三TLV字段携带协议组标识和协议组标识对应的处理方式。第二TLV字段参见如下的表2，第三TLV字段参见如下的表3。在表2和表3中，动作(action)即为处理方式包括的动作。
表2
类型 长度 值
字符串(string) 不限 URL组标识
string 不限 动作
表3
类型 长度 值
string 不限 协议组标识
string 不限 动作
在一些实施方式中，AAA服务器包括RADIUS服务器。此种情况下，认证授权计费信息和SA策略由RADIUS服务器通过RADIUS协议发送。
其中，一个SA策略可以由一个策略ID唯一指示，在发送SA策略时，还需要发送用于指示SA策略的策略ID。因此，本申请实施例需要对RADIUS协议进行扩展，使得RADIUS协议能够携带策略ID。示例性地，策略ID携带在RADIUS报文的TLV字段中，RADIUS报文为使用RADIUS协议的报文。对RADIUS协议进行的扩展包括：增加如下表4所示的第四TLV字段。
表4
类型 长度 值
string 不限 策略ID
在表4中，类型字段的长度例如为1-31(不含结束符)，长度字段的长度例如为3-33，值字段用于携带策略ID。
在另一些实施方式中，AAA服务器包括PCRF服务器。认证授权计费信息和SA策略由PCRF服务器通过PCRF协议发送。此时，PCRF协议的扩展方式可以与RADIUS协议的扩展方式类似，在此不再赘述。
1302，宽带接入设备根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程。
其中，第一用户的接入认证过程又称第一用户的拨号上网过程。在接入认证过程中，该第一用户使用的用户终端通过以太网的点对点协议(point to point protocol over Ethernet，PPPoE)发送请求，请求中包括用户终端对应的第一用户的用户ID，该用户ID用于对第一用户使用的用户终端进行唯一指示。之后，AAA服务器会接收到基于该请求发送的认证授权报文，认证授权报文中携带了用户ID和IP地址，IP地址是需要分配给用户终端的地址。AAA服务器解析该认证授权报文得到用户ID，确认用户ID所指示的用户终端是否能够上网(也即接入目的网络)以及上网后所具有的权限，得到认证授权信息。如果该认证授权信息指示用户终端能够上网且具有一定的权限，则上述IP地址会分配给用户终端。在用户终端获得IP地址之后，用户终端可以使用该IP地址发送报文，所发送的报文中携带该IP地址。
通过情况一至情况七对各个类型的流量管理系统根据认证授权信息实现第一用户的接入认证过程的方式进行说明。
对应于类型一的流量管理系统的情况一，参见图6，宽带接入设备包括BNG模块和SA前台模块。BNG模块接收用户终端发送的请求，BNG模块确定需要向用户终端分配的IP地址，基于请求中携带的用户ID和IP地址生成认证授权报文，向AAA服务器发送认证授权报文。之后，BNG模块接收AAA服务器发送的认证授权信息，如果该认证授权指示用户终端能够上网且具有一定的权限，则BNG模块向用户终端分配该IP地址。
对应于类型二的流量管理系统的情况二，参见图7，宽带接入设备包括BNG模块和SA前台模块，情况二与情况一相同，此处不再进行赘述。
对应于类型三的流量管理系统的情况三，参见图8，宽带接入设备包括CP设备和UP设备，CP设备包括SA后台模块，UP设备包括SA前台模块。UP设备接收用户终端发送的请求，向CP设备转发该请求。之后，CP设备确定需要向用户终端分配的IP地址，基于请求中携带的用户ID和IP地址生成认证授权报文，向AAA服务器发送认证授权报文。接着，CP设备接收AAA服务器发送的认证授权信息，如果该认证授权信息指示用户终端能够上网且具有一定的权限，则CP设备向UP设备发送该IP地址，UP设备向用户终端分配该IP地址。
对应于类型四的流量管理系统的情况四，参见图9，宽带接入设备包括CP设备，CP设备包括SA后台模块。SA前台设备接收用户终端发送的请求，向CP设备转发该请求。之后，CP设备确定需要向用户终端分配的IP地址，基于请求中携带的用户ID和IP地址生成认证授权报文，向AAA服务器发送认证授权报文。接着，CP设备接收AAA服务器发送的认证授权信息，如果该认证授权信息指示用户终端能够上网且具有一定的权限，则CP设备向SA前台设备发送该IP地址，SA前台设备向用户终端分配该IP地址。
对应于类型五的流量管理系统的情况五，参见图10，宽带接入设备包括CP模块、UP模块和SA前台模块。UP模块接收用户终端发送的请求，向CP模块转发该请求。之后，CP模 块确定需要向用户终端分配的IP地址，基于请求中携带的用户ID和IP地址生成认证授权报文，向AAA服务器发送认证授权报文。接着，CP模块接收AAA服务器发送的认证授权信息，如果该认证授权信息指示用户终端能够上网且具有一定的权限，则CP模块向UP模块发送该IP地址，UP模块向用户终端分配该IP地址。
对应于类型六的流量管理系统的情况六，参见图11，宽带接入设备包括CP模块、UP模块和SA前台模块。情况六与情况五相同，此处不再进行赘述。
对应于类型七的流量管理系统的情况七，参见图12，宽带接入设备包括包括SA前台设备和SA后台设备。SA前台设备包括UP模块，SA后台设备包括CP模块。SA前台设备接收用户终端发送的请求，向SA后台设备转发该请求。之后，SA后台设备包括的CP模块确定需要向用户终端分配的IP地址，基于请求中携带的用户ID和IP地址生成认证授权报文，使得SA后台设备向AAA服务器发送认证授权报文。接着，SA后台设备接收AAA服务器发送的认证授权信息，如果该认证授权信息指示用户终端能够上网且具有一定的权限，则SA后台设备向SA前台设备发送该IP地址，SA前台设备向用户终端分配该IP地址。
另外，通过情况一至情况七对各个类型的流量管理系统根据计费信息实现第一用户的流量的计费过程的方式进行说明。其中，根据上文步骤1301中的说明可知，第一用户的流量包括第一用户的参考业务的流量，参考业务无需使用SA策略。示例性地，本申请实施例首先统计得到第一用户的参考业务的流量的统计信息(以下称第一统计信息)，再基于计费信息和第一统计信息对第一用户的参考业务的流量进行计费。
对应于类型一的流量管理系统的情况一，参见图6，宽带接入设备包括BNG模块和SA前台模块。BNG模块统计得到第一统计信息，基于计费信息和第一统计信息进行计费。
对应于类型二的流量管理系统的情况二，参见图7，宽带接入设备包括BNG模块和SA前台模块，情况二与上述情况一相同，此处不再进行赘述。
对应于类型三的流量管理系统的情况三，参见图8，宽带接入设备包括CP设备和UP设备，CP设备包括SA后台模块，UP设备包括SA前台模块。UP设备统计得到第一统计信息，向CP设备发送第一统计信息，CP设备基于接收的第一统计信息和计费信息进行计费。
对应于类型四的流量管理系统的情况四，参见图9，宽带接入设备包括CP设备，CP设备包括SA后台模块。SA前台设备统计得到第一统计信息，向CP设备发送第一统计信息，CP设备基于计费信息和第一统计信息进行计费。
对应于类型五的流量管理系统的情况五，参见图10，宽带接入设备包括CP模块、UP模块和SA前台模块。UP模块统计得到第一统计信息，向CP模块发送第一统计信息，CP模块基于计费信息和第一统计信息进行计费。
对应于类型六的流量管理系统的情况六，参见图11，宽带接入设备包括CP模块、UP模块和SA前台模块。情况六与情况五相同，此处不再进行赘述。
对应于类型七的流量管理系统的情况七，参见图12，宽带接入设备包括包括SA前台设备和CP模块，SA前台设备包括UP模块，CP模块位于SA后台设备中。SA前台设备包括的UP模块统计得到第一统计信息，SA前台设备向SA后台设备发送第一统计信息，SA后台设备包括的CP模块基于计费信息和第一统计信息进行计费。
此外，本申请实施例中，SA前台模块还根据该SA策略对来自于第一用户的目标业务的流量进行处理。因此，当宽带接入设备包括SA前台模块时，该宽带接入设备能够根据该SA 策略对来自于第一用户的目标业务的流量进行处理。例如，图6、图7、图8、图10、图11和图12所示的宽带接入设备能够根据该SA策略对来自于第一用户的目标业务的流量进行处理。另外，图9所示的SA前台设备也能够根据该SA策略对来自于第一用户的目标业务的流量进行处理。
其中，该来自于第一用户的目标业务的流量包括第一报文，第一报文由第一用户使用的用户终端发送。基于图4所示的网络架构可知，第一报文依次通过RG设备、ONT设备和OLT设备传输至流量管理系统。在示例性实施例中，方法还包括，SA前台模块接收第一报文，确定第一报文属于第一用户，确定第一报文属于目标业务。根据SA策略对来自于第一用户的目标业务的流量进行处理，包括：SA前台模块基于第一报文属于第一用户且属于目标业务，按照SA策略中的处理方式对第一报文进行处理。
示例性地，SA前台模块确定第一报文属于第一用户，包括：SA前台模块基于第一报文的源地址确定第一报文属于第一用户。其中，解析第一报文能够得到第一报文的源地址，第一报文的源地址也即是发送该第一报文的用户终端在接入认证过程中分配到的IP地址。因此，如果第一报文的源地址与第一用户使用的用户终端分配到的IP地址相同，则能够确定第一报文属于第一用户。
示例性地，SA前台模块确定第一报文属于目标业务，包括：SA前台模块通过特征库对第一用户进行识别，得到第一用户所属的业务。如果第一用户所属的业务与目标业务相同，则能够确定第一报文属于目标业务。示例性地，该特征库为二进制数据文件，该特征库由SA后台模块生成并发送至SA前台。该特征库可以包括应用层协议和应用程序所特有的识别特征。在进行应用层协议或应用程序识别时，SA前台包括的识别引擎会对数据报文进行特征分析，并与特征库中各种识别特征进行比较，根据比较结果得出识别结果。示例性地，SA前台模块存储有源地址与策略ID的第一对应关系。由于解析第一报文可以得到第一报文的源地址，因而可以根据第一报文的源地址查询第一对应关系，得到源地址对应的策略ID，从而得到该策略ID指示的SA策略。根据上文可知，SA策略包括目标业务的标识与处理方式之间的对应关系，因而该SA策略包括的目标业务的标识所指示的业务即为目标业务。
在按照上述说明确定第一报文属于第一用户且属于目标业务之后，查询SA策略能够得到目标业务的标识对应的处理方式，从而可以按照SA策略中的处理方式对第一报文进行处理。例如，SA策略包括URL标识(即目标业务的标识)和用于指示采用加速通道网络的带宽控制(即处理方式)之间的对应关系。在确定第一报文属于第一用户且属于URL标识所指示的URL的情况下，则采用加速通道网络传输该第一报文，从而对第一报文进行了加速传输。
另外，在第一报文属于第一用户但不属于目标业务的情况下，则无需查询SA策略，直接按照参考方式对第一报文进行处理即可。仍以SA策略包括URL标识和用于指示采用加速通道网络的带宽控制之间的对应关系为例，在确定第一报文属于第一用户且不属于URL标识所指示的URL的情况下，则不采用加速通道网络传输该第一报文，而是按照参考方式，例如采用公众互联骨干网的方式，传输该第一报文，此种情况下未对第一报文进行加速传输。
接下来，通过情况一至情况七对各个类型的流量管理系统对来自于第一用户的目标业务的流量进行处理的方式进行说明。
对应于类型一的流量管理系统的情况一，参见图6，宽带接入设备包括BNG模块和SA前台模块。BNG模块接收用户终端发送的第一报文，SA前台模块通过BNG模块获得第一报 文。SA前台模块确定第一报文属于第一用户且属于目标业务之后，按照SA策略中的处理方式对第一报文进行处理。
在情况一中，SA前台模块使用的SA策略和第一对应关系均由BNG模块发送。
示例性地，第一对应关系由BNG模块根据源地址与用户ID之间的第二对应关系生成，用户ID用于指示用户终端。源地址也即是用户终端在接入认证过程中分配到的IP地址，BNG模块在认证接入过程中获得该第二对应关系。另外，用户终端在发送报文之前，会订阅SA策略，由于用户终端由用户ID指示，SA策略由策略ID指示，因而形成了用户ID和策略ID的第三对应关系，该第三对应关系存储于AAA服务器中。BNG模块向AAA服务器发送用户ID，AAA服务器根据用户ID查询第三对应关系，得到用户ID对应的策略ID，向BNG模块返回用户ID对应的策略ID，则BNG模块根据用户ID对应的策略ID和第二对应关系生成上述第一对应关系，再向SA前台模块发送该第一对应关系。
对应于类型二的流量管理系统的情况二，参见图7，宽带接入设备包括BNG模块和SA前台模块，情况二中SA前台模块对第一报文进行处理的方式参见情况一中的说明，此处不再进行赘述。
在情况二中，SA前台模块使用的SA策略由SA后台模块发送，SA前台模块使用的第一对应关系由BNG模块或者SA后台模块发送。BNG模块生成第一对应关系的方式参见上文情况一，此处不再进行赘述。
示例性地，当由SA后台模块向SA前台模块发送第一对应关系时，第一对应关系由SA后台模块根据上述第二对应关系生成。BNG模块在接入认证过程中向AAA服务器发送的认证授权报文也会抄送至SA后台模块，因而SA后台模块可以通过认证授权报文获得上述第二对应关系。另外，SA后台模块中还存储有SA策略与策略ID的对应关系。在SA后台模块得到第二对应关系之后，SA后台模块可以向AAA服务器发送用户ID，得到服务器基于上述第三对应关系返回的用户ID对应的策略ID，从而根据用户ID对应的策略ID和第二对应关系生成上述第一对应关系。或者，SA后台可以向AAA服务器发送策略ID，服务器根据策略ID查询第三对应关系，得到策略ID对应的用户ID，向SA后台模块返回策略ID对应的用户ID，则SA后台模块根据策略ID对应的用户ID和第二对应关系生成第一对应关系。总之，SA后台模块能够根据上述第二对应关系生成上述第一对应关系，从而向SA前台模块发送第一对应关系。
示例性地，SA后台模块向SA前台模块发送SA策略，包括：SA前台模块向SA后台模块发送请求消息，请求消息包括第一用户对应的源地址，也即第一报文的源地址。SA后台模块接收请求消息之后，根据第一报文的源地址查询所生成的上述第一对应关系，得到源地址对应的策略ID，从而将策略ID所指示的SA策略返回给SA前台模块。因此，SA前台模块使用的SA策略可以由SA后台模块发送。
对应于类型三的流量管理系统的情况三，参见图8，宽带接入设备包括CP设备和UP设备，CP设备包括SA后台模块，UP设备包括SA前台模块。UP设备接收用户终端发送的第一报文，UP设备包括的SA前台模块得到该第一报文。SA前台模块确定第一报文属于第一用户且属于目标业务之后，按照SA策略中的处理方式对第一报文进行处理。
在情况三中，SA前台模块使用的SA策略和第一对应关系均由CP设备向UP设备发送，则UP设备包括的SA前台模块可以得到SA策略和第一对应关系。CP设备获取第一对应关 系的过程参见上文情况一中BNG模块获取第一对应关系的过程，此处不再进行赘述。
对应于类型四的流量管理系统的情况四，参见图9，SA前台设备接收用户终端发送的第一报文，SA前台设备确定第一报文属于第一用户且属于目标业务之后，按照SA策略中的处理方式对第一报文进行处理。
在情况四中，SA前台设备使用的SA策略和第一对应关系均由CP设备发送。CP设备获取第一对应关系的过程参见上文情况一中BNG模块获取第一对应关系的过程，此处不再进行赘述。
对应于类型五的流量管理系统的情况五，参见图10，宽带接入设备包括CP模块、UP模块和SA前台模块。UP模块接收用户终端发送的第一报文，向SA前台模块转发第一报文。SA前台模块确定第一报文属于第一用户且属于目标业务之后，按照SA策略中的处理方式对第一报文进行处理。
在情况五中，SA前台模块使用的SA策略和第一对应关系均由UP模块发送，且UP模块发送的SA策略和第一对应关系均来自于CP模块。CP模块生成第一对应关系的方式参见上文情况一中BNG模块生成第一对应关系的方式，此处不再进行赘述。
对应于类型六的流量管理系统的情况六，参见图11，宽带接入设备包括CP模块、UP模块和SA前台模块，情况六中SA前台模块对第一报文进行处理的方式参见情况五中的说明，此处不再进行赘述。
在情况六中，SA前台模块使用的SA策略由SA后台模块发送。SA后台模块向SA前台模块发送SA策略的方式参见上文情况二中的说明，此处不再进行赘述。SA前台模块使用的第一对应关系由UP模块或者SA后台模块发送，UP模块发送的第一对应关系来自于CP模块。其中，CP模块生成第一对应关系的方式参见上文情况一中BNG模块生成第一对应关系的方式，SA后台模块生成第一对应关系的方式参见上文情况二中SA后台模块生成第一对应关系的方式，此处不再进行赘述。
对应于类型七的流量管理系统的情况七，参见图12，SA前台设备接收用户终端发送的第一报文，SA前台设备确定第一报文属于第一用户且属于目标业务之后，按照SA策略中的处理方式对第一报文进行处理。
在情况七中，SA前台设备使用的SA策略和第一对应关系均由SA后台设备发送。SA后台设备向SA前台设备发送SA策略的方式参见上文情况二中的说明，此处不再进行赘述。SA后台设备生成第一对应关系的方式参见上文情况二中SA后台模块生成第一对应关系的方式，此处不再进行赘述。
在示例性实施例中，该方法还包括：SA前台模块(或SA前台设备)获得来自于第一用户的目标业务的流量的统计信息(以下称为第二统计信息，以与上文说明中的第一统计信息进行区分)。其中，该第二统计信息包括但不限于：数据量、时长、时延等等，本申请实施例不对第二统计信息加以限定。示例性地，第二统计信息(例如数据量和时长)可以用于针对来自于第一用户的目标业务的流量进行计费，第二统计信息(例如时延)还可以用于进行数据分析。
示例性地，本申请实施例还提供SA标识，以便于区分上述第一统计信息和第二统计信息。示例性地，该SA标识为TLV字段。本申请实施例对RADIUS协议进行扩展，使得RADIUS报文中携带第五TLV字段，RADIUS报文为使用RADIUS协议的报文。该第五TLV字段参 见如下的表5。在表5中，类型字段的长度例如为1-31(不含结束符)，长度字段的长度例如为3-33，值字段携带SA标识。
表5
类型 长度 值
string 不限 SA标识
示例性地，SA策略对应有策略计费信息，策略计费信息用于实现第一用户的目标业务的流量的计费过程。本申请实施例中，基于策略计费信息和第二统计信息对第一用户的目标业务的流量进行计费。
通过情况一至情况七对各个类型的流量管理系统对来自于第一用户的目标业务的流量进行计费的方式进行说明。
对应于类型一的流量管理系统的情况一，参见图6，宽带接入设备包括BNG模块和SA前台模块。SA前台模块统计得到第二统计信息，向BNG模块发送第二统计信息，BNG模块基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型二的流量管理系统的情况二，参见图7，宽带接入设备包括BNG模块和SA前台模块，SA前台模块统计得到第二统计信息，向SA后台模块发送第二统计信息，SA后台模块基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型三的流量管理系统的情况三，参见图8，宽带接入设备包括CP设备和UP设备，CP设备包括SA后台模块，UP设备包括SA前台模块。SA前台模块统计得到第二统计信息，通过UP设备向CP设备发送第二统计信息，CP设备基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型四的流量管理系统的情况四，参见图9，宽带接入设备包括CP设备，CP设备包括SA后台模块。SA前台设备统计得到第二统计信息，向CP设备发送第二统计信息，CP设备基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型五的流量管理系统的情况五，参见图10，宽带接入设备包括CP模块、UP模块和SA前台模块。SA前台模块统计得到第二统计信息，通过UP模块向CP模块发送第二统计信息。CP模块基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型六的流量管理系统的情况六，参见图11，宽带接入设备包括CP模块、UP模块和SA前台模块。SA前台模块统计得到第二统计信息，通过UP模块向SA后台模块发送第二统计信息。SA后台模块基于第二统计信息和SA策略对应的策略计费信息进行计费。
对应于类型七的流量管理系统的情况七，参见图12，宽带接入设备包括包括SA前台设备和CP模块，SA前台设备包括UP模块，CP模块位于SA后台设备中。SA前台设备统计得到第二统计信息，向SA后台设备发送第二统计信息，SA后台设备基于第二统计信息和SA策略对应的策略计费信息进行计费。
以上，对本申请实施例提供的流量管理方法进行了说明。基于该方法，本申请实施例能够提供多种宽带业务。需要说明的是，以下宽带业务中需要使用的信息，均为用户知情且同意的情况下获取的信息。各种宽带业务参见如下说明。
质差分析业务：获取来自于用户的目标业务的流量的统计信息，该统计信息包括时延，基于该时延分析得到质差用户，针对质差用户优化通信体验。示例性地，还可以对质差用户进行分级，从而针对不同级别的质差用户采用不同的优化方式。
用户画像业务：识别用户的报文属于的目标业务，通过分析用户偏好访问的目标业务，得到用户画像，从而基于该用户画像提升用户的通信体验。例如，分析得到用户画像为：用户偏好游戏类URL，则可以在游戏类URL上优化用户的通信体验。
阻断业务：识别用户的报文属于的目标业务，根据实际需求对报文进行阻断。例如，报文属于的目标业务禁止使用，则可以对报文进行阻断。由此，可以避免造成安全性问题或违反相关规定，保证了用户的通信体验。
针对性业务：通过获取来自于用户的目标业务的流量的统计信息，可以确定用户在上网过程中使用各个目标业务的情况。由此，可以根据用户使用目标业务的情况有针对性的向用户推荐合适的SA策略，从而提升用户的通信体验。例如，响应于检测到用户使用目标URL的频率较高，则可以向用户推荐与目标URL相关的SA策略，例如针对目标URL进行加速的SA策略，从而提升用户在使用目标URL时的通信体验。
综上所述，本申请实施例中AAA服务器既可以下发认证授权计费信息，又可以下发SA策略。宽带接入设备除了获取认证授权计费信息以外，还获取SA策略。因此，无需在网络架构中分别设置两个不同的服务器，从而简化了用于进行流量管理的网络架构，通过简洁的网络架构实现了流量管理。
此外，基于本申请实施例提供的网络架构，还可以在宽带业务中增加SA能力。
本申请实施例还提供了一种流量管理方法，该方法应用于AAA服务器，所述AAA服务器可以为图6-图12所示的AAA服务器，参见图14，该方法包括如下的步骤1401。
步骤1401，AAA服务器向目标设备发送SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
步骤1401参见上文步骤1301和1302中的说明，此处不再进行赘述。
本申请实施例还提供了一种流量管理方法，该方法应用于SA后台设备，所述SA后台设备可以为图6-图12所示的SA后台设备或图6-图12所示的SA后台模块所在的设备，参见图15，该方法包括如下的步骤1501。
步骤1501，SA后台设备接收AAA服务器发送的SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。
步骤1501参见上文步骤1301和1302中的说明，此处不再进行赘述。
本申请实施例还提供了一种流量管理方法，该方法应用于宽带接入系统，系统包括宽带接入设备、AAA服务器和SA后台设备，其中，所述宽带接入设备可以为图6-图12所示的宽带接入设备，所述AAA服务器可以为图6-图12所示的AAA服务器，所述SA后台设备可以为图6-图12所示的SA后台设备或图6-图12所示的SA后台模块所在的设备，方法包括：
AAA服务器向SA后台设备发送SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
AAA服务器向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，宽带接入设备还用于执行SA前台模块的功能，方法还包括：SA后台设备向宽带接入设备发送SA策略，宽带接入设备根据SA策略对来自于第一用户的目 标业务的流量进行处理。
本申请实施提供了一种流量管理方法，方法应用于宽带接入系统，系统包括宽带接入设备和AAA服务器，方法包括：
AAA服务器向宽带接入设备发送认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
宽带接入设备根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程；
宽带接入设备根据SA策略对来自于第一用户的目标业务的流量进行处理，宽带接入设备还用于执行SA前台模块的功能。
本申请实施例还提供了一种流量管理方法，方法应用于宽带接入系统，系统包括SA后台设备和AAA服务器，其中，所述AAA服务器可以为图6-图12所示的AAA服务器，所述SA后台设备可以为图6-图12所示的SA后台设备或图6-图12所示的SA后台模块所在的设备，方法包括：
AAA服务器向SA后台设备发送认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；
SA后台设备根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程，SA后台设备用于执行vBNG系统中的CP模块的功能；
SA后台设备向SA前台设备发送SA策略，SA前台设备用于执行vBNG系统中的UP模块的功能。
其中，应用于宽带接入系统的各方法可以参见上文步骤1301和1302中的说明，此处不再进行赘述。并且，宽带接入系统可以参见上文图5-12中对流量管理系统的说明，此处不再进行赘述。
以上介绍了本申请实施例提供的流量管理方法，与上述方法对应，本申请实施例还提供了图16、17和18所示的流量管理装置。其中，图16所示的流量管理装置用于通过图16所示的各个模块，执行上文方法实施例中宽带接入设备所执行的方法。图17所示的流量管理装置用于通过图17所示的各个模块，执行上文方法实施例中AAA服务器所执行的方法。图18所示的装置用于通过图18所示的各个模块，执行上文方法实施例中SA后台设备所执行的方法。以下对各个流量管理装置分别进行说明。
如图16所示，本申请实施例提供了一种流量管理装置，该装置应用于宽带接入设备，该装置包括如下的模块。
接收模块1601，用于接收AAA服务器发送的认证授权计费信息和SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式；接收模块1601可以用于执行图13所示的步骤1301。
实现模块1602，用于根据认证授权计费信息实现第一用户的接入认证过程以及第一用户的流量的计费过程。接收模块1602可以用于执行图13所示的步骤1302。
在一种可能的实现方式中，宽带接入设备还用于执行SA前台模块的功能，装置还包括：处理模块，用于根据SA策略对来自于第一用户的目标业务的流量进行处理。
在一种可能的实现方式中，接收模块1601，还用于接收第一报文；
装置还包括：确定模块，用于确定第一报文属于第一用户；确定第一报文属于目标业务；
处理模块用于基于第一报文属于第一用户且属于目标业务，按照SA策略中的处理方式对第一报文进行处理。
在一种可能的实现方式中，确定模块，用于基于第一报文的源地址确定第一报文属于第一用户。
在一种可能的实现方式中，装置还包括：获得模块，用于获得来自于第一用户的目标业务的流量的统计信息。
在一种可能的实现方式中，宽带接入设备为vBNG系统，vBNG系统包括CP设备和UP设备，CP设备用于接收服务器发送的SA策略，UP设备用于执行SA前台模块的功能。
在一种可能的实现方式中，装置还包括：第一发送模块，用于CP设备通过CUSP向UP设备发送SA策略。
在一种可能的实现方式中，宽带接入设备为vBNG系统中的CP设备，装置还包括：第二发送模块，用于CP设备向SA前台设备发送SA策略，SA前台设备用于根据SA策略对来自于第一用户的目标业务的流量进行处理。
在一种可能的实现方式中，第二发送模块，用于CP设备通过CUSP向SA前台设备发送SA策略。
在一种可能的实现方式中，SA策略携带在CUSP报文的TLV字段中。
在一种可能的实现方式中，SA策略包括目标业务的标识与处理方式的对应关系，目标业务的标识包括以下至少一种：应用层协议标识、应用层协议组标识、URL标识或URL组标识。
在一种可能的实现方式中，接收模块1601，用于通过RADIUS协议接收AAA服务器发送的认证授权计费信息和SA策略。
在一种可能的实现方式中，接收模块1601，用于通过PCRF协议接收AAA服务器发送的认证授权计费信息和SA策略。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或者重定向。
如图17所示，本申请实施例提供了一种流量管理装置，该装置应用于AAA服务器，该装置包括如下的模块。
发送模块1701，用于向目标设备发送SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。发送模块1701可以用于执行图14所示的步骤1401。
在一种可能的实现方式中，目标设备为宽带接入设备，发送模块1701，还用于向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，宽带接入设备包括vBNG系统中的CP设备。
在一种可能的实现方式中，目标设备为SA后台设备，发送模块1701，还用于向宽带接入设备发送认证授权计费信息，认证授权计费信息用于宽带接入设备实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行 以下至少一种处理：带宽控制、镜像或重定向。
如图18所示，本申请实施例提供了一种流量管理装置，该装置应用于SA后台设备，该装置包括如下的模块。
接收模块1801，用于接收AAA服务器发送的SA策略，SA策略指示针对第一用户的目标业务的流量的处理方式。接收模块1801可以用于执行图15所示的步骤1501。
在一种可能的实现方式中，装置还包括：发送模块，用于向SA前台设备发送SA策略。
在一种可能的实现方式中，发送模块，用于基于SA前台设备发送的请求消息，向SA前台设备发送SA策略，请求消息包括第一用户对应的源地址。
在一种可能的实现方式中，SA后台设备用于执行vBNG系统中的CP模块的功能，SA前台设备用于执行vBNG系统中的UP模块的功能，接收模块1801，还用于接收服务器发送的认证授权计费信息，认证授权计费信息用于CP模块和UP模块实现第一用户的接入认证过程以及第一用户的流量的计费过程。
在一种可能的实现方式中，发送模块，用于通过CUSP向SA前台设备发送SA策略。
在一种可能的实现方式中，SA策略和认证授权计费信息通过RADIUS协议发送。
在一种可能的实现方式中，SA策略和认证授权计费信息通过PCRF协议发送。
在一种可能的实现方式中，针对第一用户的目标业务的流量的处理方式包括对流量进行以下至少一种处理：带宽控制、镜像或重定向。
综上所述，本申请实施例中AAA服务器既可以下发认证授权计费信息，又可以下发SA策略。因此，无需在网络架构中分别设置两个不同的服务器，从而简化了用于进行流量管理的网络架构，通过简洁的网络架构实现了流量管理。
应理解的是，上述图16、17和18提供的装置在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的装置与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
在示例性实施例中，本申请实施例提供了一种流量管理设备，设备包括存储器及处理器；存储器中存储有至少一条指令，至少一条指令由处理器加载并执行，以使流量管理设备实现上述图13、14或15所示的流量管理方法。
参见图19，图19示出了本申请一示例性的流量管理设备1900的结构示意图，该流量管理设备1900包括至少一个处理器1901、存储器1903以及至少一个网络接口1904。
处理器1901例如是通用CPU、数字信号处理器(digital signal processor，DSP)、网络处理器(network processer，NP)、GPU、神经网络处理器(neural-network processing units，NPU)、数据处理单元(data processing unit，DPU)、微处理器或者一个或多个用于实现本申请方案的集成电路或专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。PLD例如是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。其可以实现或执行结合本申请公开内容所描述的各种逻辑方框、 模块和电路。处理器也可以是实现计算功能的组合，例如包括一个或多个微处理器组合，DSP和微处理器的组合等等。
可选的，流量管理设备1900还包括总线1902。总线1902用于在流量管理设备1900的各组件之间传送信息。总线1902可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。总线1902可以分为地址总线、数据总线、控制总线等。为便于表示，图19中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器1903例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器1903例如是独立存在，并通过总线1902与处理器1901相连接。存储器1903也可以和处理器1901集成在一起。
网络接口1904使用任何收发器一类的装置，用于与其它设备或通信网络通信，通信网络可以为以太网、无线接入网(radio access network，RAN)或无线局域网(wireless local area network，WLAN)等。网络接口1904可以包括有线网络接口，还可以包括无线网络接口。具体的，网络接口1904可以为以太(Ethernet)接口，如：快速以太(fast Ethernet，FE)接口、千兆以太(gigabit Ethernet，GE)接口，异步传输模式(asynchronous transfer mode，ATM)接口，WLAN接口，蜂窝网络接口或其组合。以太网接口可以是光接口，电接口或其组合。在本申请的一些实施方式中，网络接口1904可以用于流量管理设备1900与其他设备进行通信。
在具体实现中，作为一些实施方式，处理器1901可以包括一个或多个CPU，如图19中所示的CPU0和CPU1。这些处理器中的每一个可以是一个单核处理器，也可以是一个多核处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一些实施方式，流量管理设备1900可以包括多个处理器，如图19中所示的处理器1901和处理器1905。这些处理器中的每一个可以是一个单核处理器，也可以是一个多核处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施方式中，存储器1903用于存储执行本申请方案的程序指令1910，处理器1901可以执行存储器1903中存储的程序指令1910。也即是，流量管理设备1900可以通过处理器1901以及存储器1903中的程序指令1910，来实现图13、14或15所示的方法实施例提供的方法。程序指令1910中可以包括一个或多个软件模块。可选地，处理器1901自身也可以存储执行本申请方案的程序指令。
在具体实施过程中，本申请的流量管理设备1900可对应于用于执行上述方法的第一网元设备，流量管理设备1900中的处理器1901读取存储器1903中的指令，使图19所示的流量管理设备1900能够执行方法实施例中的全部或部分步骤。
流量管理设备1900还可以对应于上述图16、17或18所示的装置，图16、17或18所示的装置中的每个功能模块采用流量管理设备1900的软件实现。换句话说，图16、17或18所示的装置包括的功能模块为流量管理设备1900的处理器1901读取存储器1903中存储的程序指令1910后生成的。
其中，图13、14或15所示的方法的各步骤通过流量管理设备1900的处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请所公开的方法实施例的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法实施例的步骤，为避免重复，这里不再详细描述。
应理解的是，上述处理器可以是中央处理器(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processing，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field－programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。值得说明的是，处理器可以是支持进阶精简指令集机器(advanced RISC machines，ARM)架构的处理器。
进一步地，在一种可选的实施例中，上述存储器可以包括只读存储器和随机存取存储器，并向处理器提供指令和数据。存储器还可以包括非易失性随机存取存储器。例如，存储器还可以存储设备类型的信息。
该存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用。例如，静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic random access memory，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
在示例性实施例中，本申请实施例提供了一种计算机程序(产品)，计算机程序(产品)包括：计算机程序代码，当计算机程序代码被计算机运行时，使得计算机执行上述图13、14或15所示的流量管理方法。
在示例性实施例中，本申请实施例提供了一种计算机可读存储介质，计算机可读存储介质存储程序或指令，当程序或指令在计算机上运行时，上述图13、14或15所示的流量管理方法被执行。
在示例性实施例中，本申请实施例提供了一种芯片，包括处理器，用于从存储器中调用并运行存储器中存储的指令，使得安装有芯片的通信设备执行上述图13、14或15所示的流量 管理方法。
在示例性实施例中，本申请实施例提供另一种芯片，包括：输入接口、输出接口、处理器和存储器，输入接口、输出接口、处理器以及存储器之间通过内部连接通路相连，处理器用于执行存储器中的代码，当代码被执行时，处理器用于执行上述图13、14或15所示的流量管理方法。
在示例性实施例中，本申请实施提供提供了一种网络系统，该系统包括宽带接入设备、AAA服务器和SA后台设备，宽带接入设备用于执行上述图13所示的流量管理方法，AAA服务器用于执行图14所示的流量管理方法，SA后台设备用于执行图15所示的流量管理方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk)等。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”、“第n”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。
还应理解，在本申请的各个实施例中，各个过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本申请中术语“至少一个”的含义是指一个或多个，本申请中术语“多个”的含义是指两个或两个以上，例如，多个第二设备是指两个或两个以上的第二设备。本文中术语“系统”和“网络”经常可互换使用。
应理解，在本文中对各种所述示例的描述中所使用的术语只是为了描述特定示例，而并非旨在进行限制。如在对各种所述示例的描述和所附权利要求书中所使用的那样，单数形式“一个(“a”,“an”)”和“该”旨在也包括复数形式，除非上下文另外明确地指示。
还应理解，本文中所使用的术语“和/或”是指并且涵盖相关联的所列出的项目中的一个或多个项目的任何和全部可能的组合。术语“和/或”，是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本申请中的字符“/”，一般表示前后关联对象是一种“或”的关系。
还应理解，术语“若”和“如果”可被解释为意指“当...时”(“when”或“upon”)或“响应于确定”或“响应于检测到”。类似地，根据上下文，短语“若确定...”或“若检测到[所陈述的条件或事件]”可被解释为意指“在确定...时”或“响应于确定...”或“在检测到[所陈述的条件或事件]时” 或“响应于检测到[所陈述的条件或事件]”。
以上所述仅为本申请的实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (38)

  1. 一种流量管理方法，其特征在于，所述方法应用于宽带接入设备，所述方法包括：
    所述宽带接入设备接收认证授权计费AAA服务器发送的认证授权计费信息和业务感知SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式；
    所述宽带接入设备根据所述认证授权计费信息实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程。
  2. 根据权利要求1所述的方法，其特征在于，所述宽带接入设备还用于执行SA前台模块的功能，所述方法还包括：
    所述宽带接入设备根据所述SA策略对来自于所述第一用户的所述目标业务的流量进行处理。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述宽带接入设备接收第一报文；
    所述宽带接入设备确定所述第一报文属于所述第一用户；
    所述宽带接入设备确定所述第一报文属于所述目标业务；
    所述宽带接入设备根据所述SA策略对来自于所述第一用户的所述目标业务的流量进行处理，包括：
    基于所述第一报文属于所述第一用户且属于所述目标业务，所述宽带接入设备按照所述SA策略中的所述处理方式对所述第一报文进行处理。
  4. 根据权利要求3所述的方法，其特征在于，所述宽带接入设备确定所述第一报文属于所述第一用户，包括：
    所述宽带接入设备基于所述第一报文的源地址确定所述第一报文属于所述第一用户。
  5. 根据权利要求2-4任一项所述的方法，其特征在于，所述方法还包括：
    所述宽带接入设备获得来自于所述第一用户的所述目标业务的流量的统计信息。
  6. 根据权利要求2-5任一项所述的方法，其特征在于，所述宽带接入设备为虚拟宽带网络网关vBNG系统，所述vBNG系统包括控制面CP设备和用户面UP设备，所述CP设备用于接收所述AAA服务器发送的所述SA策略，所述UP设备用于执行所述SA前台模块的功能。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述CP设备通过控制面与用户面分离协议CUSP向所述UP设备发送所述SA策略。
  8. 根据权利要求1所述的方法，其特征在于，所述宽带接入设备为vBNG系统中的CP设备，所述方法还包括：
    所述CP设备向SA前台设备发送所述SA策略，所述SA前台设备用于根据所述SA策略对来自于所述第一用户的所述目标业务的流量进行处理。
  9. 根据权利要求8所述的方法，其特征在于，所述CP设备向SA前台设备发送所述SA策略，包括：
    所述CP设备通过CUSP向所述SA前台设备发送所述SA策略。
  10. 根据权利要求7或9所述的方法，其特征在于，所述SA策略携带在CUSP报文的类型长度值TLV字段中。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述SA策略包括所述目标业务的标识与所述处理方式的对应关系，其中，所述目标业务的标识包括以下至少一种：应用层协议标识、应用层协议组标识、统一资源定位符URL标识或URL组标识。
  12. 根据权利要求1-11任一项所述的方法，其特征在于，所述宽带接入设备接收认证授权计费AAA服务器发送的认证授权计费信息和业务感知SA策略，包括：
    所述宽带接入设备通过远程身份验证拨号用户服务RADIUS协议接收所述AAA服务器发送的所述认证授权计费信息和所述SA策略。
  13. 根据权利要求1-12任一项所述的方法，其特征在于，所述宽带接入设备接收认证授权计费AAA服务器发送的认证授权计费信息和业务感知SA策略，包括：
    所述宽带接入设备通过策略和计费规则功能PCRF协议接收所述AAA服务器发送的所述认证授权计费信息和所述SA策略。
  14. 根据权利要求1-13任一项所述的方法，其特征在于，所述针对第一用户的目标业务的流量的处理方式包括对所述流量进行以下至少一种处理：带宽控制、镜像或重定向。
  15. 一种流量管理方法，其特征在于，所述方法应用于认证授权计费AAA服务器，所述方法包括：
    所述AAA服务器向目标设备发送业务感知SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式。
  16. 根据权利要求15所述的方法，其特征在于，所述目标设备为宽带接入设备，所述方法还包括：
    所述AAA服务器向所述宽带接入设备发送认证授权计费信息，所述认证授权计费信息用于所述宽带接入设备实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程。
  17. 根据权利要求16所述的方法，其特征在于，所述宽带接入设备包括虚拟宽带网络网关vBNG系统中的控制面CP设备。
  18. 根据权利要求15所述的方法，其特征在于，所述目标设备为SA后台设备，所述方法还包括：
    所述AAA服务器向宽带接入设备发送认证授权计费信息，所述认证授权计费信息用于所述宽带接入设备实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程。
  19. 根据权利要求16或18所述的方法，其特征在于，
    所述SA策略和所述认证授权计费信息通过远程认证拨号用户服务RADIUS协议发送。
  20. 根据权利要求16或18所述的方法，其特征在于，
    所述SA策略和所述认证授权计费信息通过策略和计费规则功能PCRF协议发送。
  21. 根据权利要求15-20任一项所述的方法，其特征在于，所述针对第一用户的目标业务的流量的处理方式包括对所述流量进行以下至少一种处理：带宽控制、镜像或重定向。
  22. 一种流量管理方法，其特征在于，所述方法应用于业务感知SA后台设备，所述方法包括：
    所述SA后台设备接收认证授权计费AAA服务器发送的SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式。
  23. 根据权利要求22所述的方法，其特征在于，所述方法还包括：
    所述SA后台设备向SA前台设备发送所述SA策略。
  24. 根据权利要求23所述的方法，其特征在于，所述SA后台设备向SA前台设备发送所述SA策略，包括：
    基于所述SA前台设备发送的请求消息，所述SA后台设备向所述SA前台设备发送所述SA策略，所述请求消息包括所述第一用户对应的源地址。
  25. 根据权利要求23或24所述的方法，其特征在于，所述SA后台设备用于执行虚拟宽带网络网关vBNG系统中的控制面CP模块的功能，所述SA前台设备用于执行所述vBNG系统中的用户面UP模块的功能，所述方法还包括：
    所述SA后台设备接收所述AAA服务器发送的认证授权计费信息，所述认证授权计费信息用于所述CP模块和所述UP模块实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程。
  26. 根据权利要求25所述的方法，其特征在于，所述SA后台设备向SA前台设备发送所述SA策略，包括：
    所述SA后台设备通过控制面与用户面分离协议CUSP向所述SA前台设备发送所述SA策略。
  27. 根据权利要求25所述的方法，其特征在于，
    所述SA策略和所述认证授权计费信息通过远程认证拨号用户服务RADIUS协议发送。
  28. 根据权利要求25所述的方法，其特征在于，
    所述SA策略和所述认证授权计费信息通过策略和计费规则功能PCRF协议发送。
  29. 根据权利要求22-28任一项所述的方法，其特征在于，所述针对第一用户的目标业务的流量的处理方式包括对所述流量进行以下至少一种处理：带宽控制、镜像或重定向。
  30. 一种流量管理设备，其特征在于，所述设备包括存储器及处理器；所述存储器中存储有至少一条指令，所述至少一条指令由所述处理器加载并执行，以使所述流量管理设备实现权利要求1-14中任一项所述的流量管理方法。
  31. 一种流量管理设备，其特征在于，所述设备包括存储器及处理器；所述存储器中存储有至少一条指令，所述至少一条指令由所述处理器加载并执行，以使所述流量管理设备实现权利要求15-21中任一项所述的流量管理方法。
  32. 一种流量管理设备，其特征在于，所述设备包括存储器及处理器；所述存储器中存储有至少一条指令，所述至少一条指令由所述处理器加载并执行，以使所述流量管理设备实现权利要求22-29中任一项所述的流量管理方法。
  33. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有至少一条指令，所述指令由处理器加载并执行，以使计算机实现如权利要求1-29中任一项所述的流量管理方法。
  34. 一种计算机程序产品，其特征在于，所述计算机程序产品包括至少一条指令，所述指令由处理器加载并执行，以使计算机实现如权利要求1-29中任一项所述的流量管理方法。
  35. 一种宽带接入系统，其特征在于，所述系统包括宽带接入设备、认证授权计费AAA服务器和业务感知SA后台设备，其中，
    所述AAA服务器用于向所述SA后台设备发送SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式；向所述宽带接入设备发送认证授权计费信息，所述认证授权计费信息用于所述宽带接入设备实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程。
  36. 根据权利要求35所述的系统，其特征在于，其中，
    所述SA后台设备用于向所述宽带接入设备发送所述SA策略；
    所述宽带接入设备用于根据所述SA策略对来自于所述第一用户的所述目标业务的流量 进行处理。
  37. 一种宽带接入系统，其特征在于，所述系统包括宽带接入设备和认证授权计费AAA服务器，其中，
    所述AAA服务器用于向所述宽带接入设备发送认证授权计费信息和业务感知SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式；
    所述宽带接入设备用于根据所述认证授权计费信息实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程；根据所述SA策略对来自于所述第一用户的所述目标业务的流量进行处理。
  38. 一种宽带接入系统，其特征在于，所述系统包括业务感知SA后台设备和认证授权计费AAA服务器，其中，
    所述AAA服务器用于向所述SA后台设备发送认证授权计费信息和SA策略，所述SA策略指示针对第一用户的目标业务的流量的处理方式；
    所述SA后台设备用于根据所述认证授权计费信息实现所述第一用户的接入认证过程以及所述第一用户的流量的计费过程，所述SA后台设备用于执行虚拟宽带网络网关vBNG系统中的控制面CP模块的功能；向SA前台设备发送所述SA策略，所述SA前台设备用于执行所述vBNG系统中的用户面UP模块的功能。
PCT/CN2022/107616 2021-07-31 2022-07-25 流量管理方法、装置、设备及计算机可读存储介质 WO2023011233A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202110876943.0 2021-07-31
CN202110876943 2021-07-31
CN202111467664.5A CN115701145A (zh) 2021-07-31 2021-12-03 流量管理方法、装置、设备及计算机可读存储介质
CN202111467664.5 2021-12-03

Publications (1)

Publication Number Publication Date
WO2023011233A1 true WO2023011233A1 (zh) 2023-02-09

Family

ID=85120851

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/107616 WO2023011233A1 (zh) 2021-07-31 2022-07-25 流量管理方法、装置、设备及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN115701145A (zh)
WO (1) WO2023011233A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116320088B (zh) * 2023-03-03 2023-09-15 武汉麦丰创新网络科技有限公司 一种实现aaa转发的方法及装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040056485A (ko) * 2002-12-23 2004-07-01 한국전자통신연구원 무선랜 망간 연동 시스템의 통합정보 관리기능을 가지는인증 서버 장치
CN1585405A (zh) * 2004-06-04 2005-02-23 西安电子科技大学 宽带无线ip网络安全体系结构及安全实现方法
US20120089845A1 (en) * 2009-01-28 2012-04-12 Raleigh Gregory G Verifiable device assisted service usage billing with integrated accounting, mediation accounting, and multi-account
CN105376071A (zh) * 2014-08-15 2016-03-02 中国电信股份有限公司 实现后向QoS保障与内容计费的方法、系统与PCRF
US20190158997A1 (en) * 2016-05-06 2019-05-23 Convida Wireless, Llc Traffic steering at the service layer
CN110366207A (zh) * 2018-04-10 2019-10-22 信实通信有限公司 分类和路由与用户设备相关联的网络流量的系统和方法
CN110383762A (zh) * 2017-04-14 2019-10-25 华为技术有限公司 一种实现策略控制的方法、装置和系统

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040056485A (ko) * 2002-12-23 2004-07-01 한국전자통신연구원 무선랜 망간 연동 시스템의 통합정보 관리기능을 가지는인증 서버 장치
CN1585405A (zh) * 2004-06-04 2005-02-23 西安电子科技大学 宽带无线ip网络安全体系结构及安全实现方法
US20120089845A1 (en) * 2009-01-28 2012-04-12 Raleigh Gregory G Verifiable device assisted service usage billing with integrated accounting, mediation accounting, and multi-account
CN105376071A (zh) * 2014-08-15 2016-03-02 中国电信股份有限公司 实现后向QoS保障与内容计费的方法、系统与PCRF
US20190158997A1 (en) * 2016-05-06 2019-05-23 Convida Wireless, Llc Traffic steering at the service layer
CN110383762A (zh) * 2017-04-14 2019-10-25 华为技术有限公司 一种实现策略控制的方法、装置和系统
CN110366207A (zh) * 2018-04-10 2019-10-22 信实通信有限公司 分类和路由与用户设备相关联的网络流量的系统和方法

Also Published As

Publication number Publication date
CN115701145A (zh) 2023-02-07

Similar Documents

Publication Publication Date Title
WO2021057889A1 (zh) 一种数据处理方法、装置、电子设备及存储介质
US9356844B2 (en) Efficient application recognition in network traffic
CN108259425A (zh) 攻击请求的确定方法、装置及服务器
US20130128742A1 (en) Internet Real-Time Deep Packet Inspection and Control Device and Method
CN109635550B (zh) 集群数据的权限校验方法、网关及系统
CN110708256B (zh) Cdn调度方法、装置、网络设备及存储介质
WO2023036188A1 (zh) 访问限流方法、装置、设备、存储介质及计算机程序产品
He et al. Masq: Rdma for virtual private cloud
WO2021057128A1 (zh) 一种基于nf的通信方法、设备及存储介质
CN112995163B (zh) 资源访问的鉴权方法及装置、存储介质、电子设备
EP4012980A1 (en) Application identification method and apparatus, and storage medium
EP2838243A1 (en) Capability aggregation and exposure method and system
WO2020125074A1 (zh) 消息到达率确定方法、装置、数据统计服务器及存储介质
WO2022142740A1 (zh) 一种网络切片连接方法、装置、存储介质及电子装置
CN111290696A (zh) 一种应用程序组件的流控方法及装置
WO2023011233A1 (zh) 流量管理方法、装置、设备及计算机可读存储介质
WO2021197253A1 (zh) 业务报文传输方法及相关设备
US11316916B2 (en) Packet processing method, related device, and computer storage medium
WO2019071995A1 (zh) 内容分发方法、设备及系统
JP2023508302A (ja) ネットワークセキュリティ保護方法及び保護デバイス
EP4293550A1 (en) Traffic processing method and protection system
WO2020233366A1 (zh) 无效用户操作路径识别方法、装置、设备及存储介质
US20030099200A1 (en) Parallel limit checking in a hierarchical network for bandwidth management traffic-shaping cell
BR112017010583B1 (pt) Aparelho e método de controle de cobrança
CN110198294B (zh) 安全攻击检测方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22851947

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE