WO2023116566A1 - 访问控制方法、设备及系统 - Google Patents

访问控制方法、设备及系统 Download PDF

Info

Publication number
WO2023116566A1
WO2023116566A1 PCT/CN2022/139553 CN2022139553W WO2023116566A1 WO 2023116566 A1 WO2023116566 A1 WO 2023116566A1 CN 2022139553 W CN2022139553 W CN 2022139553W WO 2023116566 A1 WO2023116566 A1 WO 2023116566A1
Authority
WO
WIPO (PCT)
Prior art keywords
level
network device
access control
hierarchical
user group
Prior art date
Application number
PCT/CN2022/139553
Other languages
English (en)
French (fr)
Inventor
黄正全
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023116566A1 publication Critical patent/WO2023116566A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of network technology, in particular to an access control method, device and system.
  • An access control list is a list of instructions applied to network devices such as routers.
  • the list of instructions can also be called access control rules or access control rules.
  • the network device can filter received service packets based on the command list, thereby effectively controlling user equipment's access to the network and ensuring network security.
  • a network administrator may configure at least one ACL for each user equipment to be controlled, and assign an identifier to each ACL.
  • the network device can perform access control on the service packets sent by the user equipment based on the ACL indicated by the identifier.
  • the above access control methods are less flexible.
  • the present application provides an access control method, device and system, which can solve the technical problem of low flexibility of the access control method in the related art.
  • an access control method applied to a first network device comprising: determining a target user identifier of a second network device, where the target user identifier indicates a hierarchical position of the second network device in a multi-level user group , the multi-level user group includes multiple levels of user groups; at least one level access control rule is determined based on the target user identifier, and the at least one level access control rule is in one-to-one correspondence with at least one level of user groups in the multi-level user group ; Based on the at least one hierarchical access control rule, perform access control on the service packets sent by the second network device.
  • the first network device can determine one or more hierarchical access control rules based on one target user identifier, flexible and efficient access control on service packets is realized.
  • the process for the first network device to determine at least one level of access control rules based on the target user identifier may include: based on the target user identifier, determining at least one level of target user groups, where the at least one level of target user groups includes the first A level user group; based on the first level user group, determine the corresponding first level access control rule, the at least one level access control rule includes the first level access control rule; correspondingly, based on the at least one level access control rule
  • the process of performing access control on the service packets sent by the second network device may include: performing first access control on the service packets sent by the second network device based on the first-level access control rule.
  • the target user group of at least one level may be a user group of a certain level to which the second network device belongs, or may include user groups of various levels to which the second network device belongs. That is, the first network device may perform the first access control on the service packets sent by the second network device based on the hierarchical access control rules corresponding to some or all hierarchical user groups to which the second network device belongs.
  • the at least one level of target user group may also include a second level user group, where the second level user group is an upper level user group of the first level user group; the first network device determines at least one target user group based on the target user identifier
  • the process of hierarchical access control rules may also include: based on the second-level user group, determining a corresponding second-level access control rule, where the at least one level access control rule includes the second-level access control rule; correspondingly, based on the at least A hierarchical access control rule, the process of performing access control on the service message sent by the second network device may also include: performing second access control on the service message sent by the second network device based on the second-level access control rule; Wherein, the second access control is performed before or after the first access control.
  • the second access control is executed before the first access control, it means that the first network device can control the traffic sent by the second network device based on the hierarchical access control rules corresponding to the user groups of each level in order of the hierarchy from high to low. Messages for access control. If the second access control is executed after the first access control, it means that the first network device can control the traffic sent by the second network device based on the hierarchical access control rules corresponding to the user groups of each level in the order of hierarchy from low to high. Messages for access control. The first network device sequentially executes the hierarchical access control rules corresponding to the user groups at each level according to the hierarchical order of the user groups, so as to realize the orderly control of the service packets sent by the second network device.
  • the process of determining at least one hierarchical access control rule based on the target user identifier may include: determining at least one hierarchical target user group based on the target user identifier, where the at least one hierarchical target user group includes a first hierarchical user group and a second-level user group, where the second-level user group is an upper-level user group of the first-level user group; based on the at least one level access control rule, the process of performing access control on the service message sent by the second network device can be The method includes: if the hierarchical access control rules corresponding to the first-level user groups are not acquired, then performing access control on the service packets sent by the second network device based on the hierarchical access control rules corresponding to the second-level user groups.
  • the user group of a certain level to which the second network device belongs may not be configured with a corresponding level access control rule. Perform access control on the service packets sent by the second network device.
  • level access control rule Perform access control on the service packets sent by the second network device.
  • the process for the first network device to determine at least one hierarchical access control rule based on the target user ID may include: determining an ID chain based on the target user ID and a target mask chain, where the ID chain includes at least one sub-ID, and the ID chain indicates The hierarchical position of the second network device in the multi-level user group, and the at least one sub-identification corresponds to at least one hierarchical user group; based on the at least one sub-identification, at least one hierarchical access control rule is determined; wherein, the target The mask chain includes at least one mask corresponding to at least one sub-identity one by one, and each mask is used to indicate the length of a corresponding sub-identity.
  • the target user ID acquired by the first network device may be a user ID in an encoded state, and the user ID in an encoded state may be composed of multiple X-ary numbers, and X may be 2, 8, or 16, etc. Since the target mask chain can indicate the length of each sub-identity in the target user ID, the first network device can accurately identify each sub-identity included in the target user ID based on the target mask chain.
  • the identity chain may include multiple sub-identities; based on the at least one sub-identity, the process of determining at least one hierarchical access control rule may include: determining a plurality of sub-identities chains composed of multiple sub-identities, wherein each sub-identity chain includes One sub-identity or multiple consecutive sub-identities, the number of sub-identities included in different sub-identity chains is different, and each sub-identity chain indicates a level of user group; determine the corresponding user group of a level indicated by each sub-identity chain A hierarchical access control rule for .
  • the target user ID includes multiple sub-identities that can form different sub-identity chains, and different sub-identity chains can indicate user groups at different levels, so the first network device identifies each sub-identity included in the target user ID based on the target mask chain. , multiple user groups at different levels to which the second network device belongs can be determined.
  • the method may further include: receiving the target mask chain delivered by the authentication server; or receiving the target user ID issued by the authentication server A level identification, and determine the target mask chain from the reference mask chain based on the level identification; wherein, the level identification is used to indicate the number of sub-identities included in the identification chain, and the reference mask chain includes multiple masks , and the number of masks included in the reference mask chain is greater than or equal to the number of sub-identities included in the identification chain.
  • the authentication server is a server for performing access authentication on the second network device.
  • the reference mask chain may be pre-configured in the first network device, for example, may be pre-delivered to the first network device by the authentication server or the controller. Since the first network device is pre-configured with a reference mask chain, when the authentication server issues the target user ID, it does not need to carry the target mask chain of the target user ID, but only needs to carry the level ID of the target user ID. . Thus, the amount of data required to be exchanged between the authentication server and the first network device is effectively reduced.
  • the process for the first network device to determine the target user identifier of the second network device may include: reporting the access authentication information of the second network device to the authentication server; receiving the target user identifier of the second network device issued by the authentication server User ID, the target user ID is issued by the authentication server after determining that the access authentication information is authenticated.
  • the authentication server After the authentication server determines that the access authentication information of the second network device passes the authentication, it issues the target user identifier of the second network device, which can ensure the security and reliability of the second network device when accessing the network.
  • the method may further include: recording a first correspondence between the message identifier and the target user identifier, where the message identifier is determined by the second network device. Carried in the message sent by the network device; based on the first correspondence and at least one hierarchical access control rule determined based on the target user identifier, record the second correspondence between the packet identifier and the at least one hierarchical access control rule ;
  • the process of performing access control on the service message sent by the second network device based on the at least one hierarchical access control rule may include: after receiving the service message sent by the second network device, from the second correspondence Determine at least one hierarchical access control rule corresponding to the message identifier of the service message; based on the at least one hierarchical access control rule, perform access control on the service message sent by the second network device.
  • the first network device can record the second correspondence, when receiving the service packet sent by the second network device later, it can directly obtain the corresponding information from the second correspondence based on the packet identifier of the service packet At least one hierarchical access control rule, and based on the obtained at least one hierarchical access control rule, access control is performed on the service message. Thus, the efficiency of access control on service packets is effectively improved.
  • the process for the first network device to determine the target user identifier of the second network device may include: receiving the first correspondence between the message identifier and the target user identifier sent by the authentication server; After the service message, based on the message identifier of the service message, determine the target user identifier of the second network device from the first correspondence.
  • the first network device may be a convergence layer device or a core layer device in the access control system.
  • the access layer device in the access control system may report an authentication message carrying the access authentication information of the second network device to the authentication server, and the authentication server may send the authentication message to the second network device after determining that the access authentication information of the second network device
  • a network device delivers the first correspondence between the message ID of the authentication message and the target user ID.
  • the process of determining at least one hierarchical access control rule based on the target user identifier may include: determining at least one hierarchical access control rule corresponding to the target user identifier based on a third correspondence between the user identifier and the hierarchical access control rule.
  • the first network device may pre-store a third corresponding relationship between user identifiers and hierarchical access control rules, and the first network device may quickly determine at least one hierarchical access control rule corresponding to the target user identifier based on the third corresponding relationship .
  • the method may further include: receiving a third correspondence between the user identifier and the hierarchical access control rule issued by the third network device.
  • the third network device may be an authentication server or a controller.
  • the target user identifier includes: a first-level sub-identity and a second-level sub-identity; wherein, the first-level sub-identity is used to indicate a first-level user group in at least one level of user groups, and the first-level sub-identity and the second-level sub-identity The combination of level sub-identities is used to indicate the secondary user group in the at least one level of user groups, and the primary user group is a user group of the upper level of the secondary user group.
  • the first network device can determine the hierarchical access control rules for user groups at two different levels based on the one target user ID.
  • the target user identifier further includes: a third-level sub-identity; the combination of the first-level sub-identity, the second-level sub-identity and the third-level sub-identity is used to indicate a third-level user group in the at least one level of user groups, And the second-level user group is a user group at the upper level of the third-level user group.
  • the target user identifier may also include more levels of sub-identities, such as four-level sub-identities and five-level sub-identities.
  • the first network device may belong to a first-level user group, and the second network device may belong to a second-level user group; correspondingly, the first network device sends to the second network device based on the at least one hierarchical access control rule
  • the process of performing access control on the service packets may include: performing access control on the service packets sent by the second network device based on the hierarchical access control rules corresponding to the first-level user group.
  • the access control system may include multiple first network devices at different levels, and the first network devices at each level may control the second network device based on the hierarchical access control rules of a part of the hierarchical range in the multi-level user group.
  • the service packets sent are for access control.
  • the first network device may perform access control on service packets based on the hierarchical access control rules of the user groups of the hierarchical level to which it belongs.
  • an access control method applied to an authentication server comprising: determining a target user identifier of a second network device, where the target user identifier indicates a hierarchical position of the second network device in a multi-level user group,
  • the multi-level user group includes multiple levels of user groups; the target user identification and/or at least one level access control rule is delivered to the first network device; wherein the target user identification is used for the first network device to determine the At least one hierarchical access control rule, and based on the at least one hierarchical access control rule, access control is performed on the service packets sent by the second network device.
  • the process for the authentication server to determine the target user identifier of the second network device may include: receiving the access authentication information of the second network device sent by the first network device; if determining the access authentication information of the second network device If the authentication passes, the target user identifier of the second network device is determined based on the access authentication information.
  • the process of delivering the target user identifier to the first network device may include: if it is determined that the access authentication information in the authentication message of the second network device is authenticated, then combining the message identifier of the authentication message with the The corresponding relationship of the target user identifier is delivered to the first network device.
  • the method may further include: sending the corresponding relationship between the user identifier and the hierarchical access control rule to the first network device, and the corresponding relationship is used for the second A network device determines the at least one hierarchical access control rule based on the target user identifier.
  • the method may further include: determining the at least one hierarchical access control rule based on the target user identifier.
  • a first network device in yet another aspect, includes at least one module, and the at least one module can be used to implement the access control method applied to the first network device provided in the above aspect.
  • an authentication server in another aspect, is provided, and the authentication server includes at least one module, and the at least one module can be used to implement the access control method applied to the authentication server provided in the above aspect.
  • a first network device in yet another aspect, includes: a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program
  • the access control method applied to the first network device provided in the above aspects is realized.
  • an authentication server includes: a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the computer program, the above aspects are realized The provided access control method applied to the authentication server.
  • a computer-readable storage medium is provided, and instructions are stored in the computer-readable storage medium, and when the instructions are run on a computer, the computer is made to execute the access control method provided in any one of the above aspects.
  • a computer program product including instructions is provided, and when the computer program product is run on a computer, the computer is made to execute the access control method provided in any one of the above aspects.
  • an access control system may include the first network device as provided in the above aspect and at least one second network device.
  • the system may also include the authentication server as provided in the above aspect.
  • the present application provides an access control method, device and system.
  • the target user identifier of the second network device can indicate the hierarchical position of the second network device in the multi-level user group
  • the first network device can, based on the target user identifier of the second network device, At least one hierarchical access control rule corresponding to at least one hierarchical user group is determined.
  • the first network device can perform precise access control on the service packets sent by the second network device.
  • the first network device can determine one or more hierarchical access control rules based on a target user identifier, flexible and efficient access control on service packets is realized.
  • FIG. 1 is a schematic structural diagram of an access control system provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of another access control system provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a multi-level user group provided by an embodiment of the present application.
  • Fig. 4 is a schematic diagram of another multi-level user group provided by the embodiment of the present application.
  • FIG. 5 is a flowchart of an access control method provided by an embodiment of the present application.
  • Fig. 6 is a schematic diagram of sub-identities of each user group in a multi-level user group provided by an embodiment of the present application;
  • Fig. 7 is a schematic diagram of sub-identities of each user group in another multi-level user group provided by the embodiment of the present application.
  • FIG. 8 is a flow chart of another access control method provided by an embodiment of the present application.
  • FIG. 9 is a flow chart of access control for service messages provided by the embodiment of the present application.
  • FIG. 10 is another flow chart of access control for service messages provided by the embodiment of the present application.
  • Fig. 11 is another flow chart of access control for business messages provided by the embodiment of the present application.
  • FIG. 12 is another flow chart for access control of service messages provided by the embodiment of the present application.
  • Fig. 13 is a flowchart of another access control method provided by the embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a first network device provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of another first network device provided by an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of an authentication server provided by an embodiment of the present application.
  • Fig. 17 is a schematic structural diagram of an access control device provided by an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of an access control system provided by an embodiment of the present application.
  • the access control system may include: a first network device 01 , multiple second network devices 02 , and an authentication server 03 .
  • the first network device 01 is used to connect at least one second network device 02 to the network
  • the authentication server 03 is used to authenticate the at least one second network device 02 before the second network device 02 accesses the network.
  • the first network device 01 may be a device with a packet forwarding function, such as a router or a switch.
  • the second network device 02 may be a device with a packet forwarding function such as a router or a switch, or may be a terminal device.
  • the terminal equipment may also be referred to as user equipment, which may be computer equipment such as a mobile phone, a notebook computer, or a desktop computer.
  • the authentication server 03 may be an independent physical server, or a server cluster composed of multiple physical servers, or may be a cloud server (also called a cloud computing service center).
  • multiple second network devices 02 may be managed in a manner of multi-level user groups.
  • the multi-level user group includes multiple user groups at different levels, and each level of user group may include one or more user groups. Wherein, except the user group at the highest level, each user group belongs to a certain user group at the upper level, and different user groups may belong to the same user group or different user groups at the upper level. Alternatively, it can be understood as: a user group with a higher level can be divided into multiple user groups with a lower level.
  • Each second network device 02 may belong to an end-level user group in the multi-level user group, and the end-level user group refers to a user group that is not further divided into user groups at a lower level.
  • each second network device 02 may belong to a certain level in the multi-level user group, or it may be understood that the user group at the level to which the second network device 02 belongs can be divided into multiple end-level user groups.
  • the access control system may further include a controller 04 .
  • the network administrator can divide the multiple second network devices 02 into multiple user groups of different levels on the controller 04 .
  • the network administrator may divide the multiple second network devices 02 into four levels of user groups based on the organizational structure of the enterprise or institution to which the multiple second network devices 02 belong.
  • the first-level user group includes two user groups, the R&D department and the marketing department.
  • the R&D department can be divided into the design department and the development department
  • the marketing department can be divided into the domestic group and the overseas group.
  • the secondary user groups may include: design department, development department, domestic group and overseas group.
  • the design department in the secondary user group can be divided into hardware design group and software design group
  • the development department can be divided into hardware development group and software development group
  • the domestic group can be divided into group 1, group 2 and group 3
  • the overseas group is not The division of user groups at the next level.
  • the three-level user groups may include: hardware design group, software design group, hardware development group, software development group, group 1, group 2 and group 3.
  • the software development group in the third-level user group is further divided into a software development group and a software development group two, and other user groups in the third-level user group are not divided into user groups at the next level.
  • the four-level user groups may include: a software development group and a software development group two.
  • the second network device 02 (such as user equipment) of employees Zhang San and Li Si belongs to the hardware design group in the third-level user group, and also belongs to the design department in the second-level user group, and the first-level user group in the R&D department.
  • the second network device 02 of employees Wang Wu and Zhao Liu belongs to the second software development group in the fourth-level user group, and also belongs to the software development group in the third-level user group, the development department in the second-level user group, and the first-level user group R&D department in the group.
  • the second network device 02 of employee Qian Qi belongs to Group 3 in the third-level user group, and also belongs to the domestic group in the second-level user group, and the marketing department in the first-level user group.
  • Employee Sun Ba's second network device 02 belongs to the overseas group in the secondary user group, and also belongs to the marketing department in the primary user group.
  • the access control system may further include a directory server, such as an active directory (active directory, AD) server.
  • a directory server such as an active directory (active directory, AD) server.
  • the organizational structure of the enterprise or institution is pre-stored in the directory server.
  • the directory server or controller 04 can automatically generate multi-level user groups based on the organizational structure.
  • the multi-level user groups automatically generated by the directory server may be as shown in FIG. 4 .
  • each second network device 02 may belong to multiple user groups at different levels, and in order to realize precise management and control of user groups at different levels, access control rules may be configured for each level of user groups. For example, network administrators can configure at least one ACL for each level of user groups on the authentication server, and assign a number to each ACL.
  • the numbering of the traditional ACL belongs to a single-level identification system, and its application flexibility is low when performing complex management and control on multi-level user groups.
  • An embodiment of the present application provides an access control method, which can realize flexible management and control of network devices in multi-level user groups.
  • the method provided by the embodiment of the present application can be applied to the first network device, and the first network device can be used to forward the service message sent by the second network device, and can perform access control on the service message sent by the second network device.
  • the first network device may be the first network device 01 in the system shown in FIG. 1 or FIG. 2 .
  • the access control method includes:
  • Step 101 Determine the target user identifier of the second network device, where the target user identifier indicates the hierarchical position of the second network device in the multi-level user group.
  • the first network device may determine a target user identifier of the second network device.
  • the first network device may send the access authentication information (such as user name and password) of the second network device to the authentication server, and the authentication server may send the authentication information to the first
  • the network device delivers the target user identifier of the second network device.
  • the first network device may receive the target user identifier of the second network device delivered by the authentication server.
  • the packet sent by the second network device may carry its own target user identifier, and correspondingly, the first network device may obtain the second network ID from the packet sent by the second network device. The target user ID of the device.
  • the first network device can determine the target user ID of the second network device based on the target user ID.
  • a user group at a certain level (such as the end-level user group), and each upper-level user group to which the user group at this level belongs. That is, the first network device can determine one or more user groups of different levels to which the second network device belongs based on the target user identifier.
  • Step 102 Determine at least one hierarchical access control rule based on the target user identifier.
  • the network administrator may configure access control rules for at least one level of user groups in the multi-level user groups.
  • access control rules can be configured for each level of user groups in a multi-level user group.
  • the first network device may determine an access control rule for controlling access to service packets sent by the second network device based on the hierarchical position of the second network device in the multi-level user group.
  • the access control rule may include at least one hierarchical access control rule, and the at least one hierarchical access control rule refers to one hierarchical access control rule or multiple hierarchical access control rules.
  • the at least one hierarchical access control rule is in one-to-one correspondence with at least one hierarchical user group in the multi-level user group.
  • the user group of at least one level may be part or all of the user groups of each level to which the second network device belongs.
  • the hierarchical access control rules may also be referred to as access control rules, packet forwarding rules, or packet filtering rules, etc., which can indicate the authority of the second network device to access the network.
  • the hierarchical access control rule may indicate network addresses that the second network device can access, and/or network addresses that are prohibited from being accessed.
  • Step 103 Based on the at least one hierarchical access control rule, perform access control on the service packets sent by the second network device.
  • the first network device may perform access control on the service message based on at least one determined hierarchical access control rule.
  • performing access control on service packets based on hierarchical access control rules may refer to: forwarding or discarding service packets based on hierarchical access control rules; or may be understood as: filtering service packets based on hierarchical access control rules.
  • the embodiment of the present application provides an access control method. Since the target user identifier of the second network device can indicate the hierarchical position of the second network device in the multi-level user group, the first network device can be based on The target user identifier of the second network device determines at least one hierarchical access control rule corresponding to at least one hierarchical user group. Thus, based on the determined at least one hierarchical access control rule, the first network device can perform precise access control on the service packets sent by the second network device. During the access control process, since the first network device can determine one or more hierarchical access control rules based on a target user identifier, flexible and efficient access control on service packets is realized.
  • the user identifier of the second network device may have two forms: a user state and an encoding state.
  • the user state is used for presentation in the user interface, so that network managers can configure and improve user experience;
  • the coded state is used for interaction between devices, for example, for the interaction between the authentication server and the first network device.
  • the user ID of the user state configured by the network administrator can also be called an ID chain, which includes a plurality of sub-identities (also called IDs, or identifiers) arranged in sequence according to the hierarchical relationship, and two adjacent sub-identities are represented by delimiter separated.
  • the delimiter can be ".”, ",” “:” or " ⁇ ", etc.
  • the embodiment of the present application does not limit the implementation form of the delimiter, as long as it is ensured that different sub-identities can be distinguished.
  • the separator is ".”
  • the user ID includes N sub-identities (N is an integer greater than 1)
  • the user ID (identity chain) of the user mode can be expressed as:
  • each sub-identity may represent a user group at one level in the multi-level user group, and the N sub-identities may be arranged sequentially according to the hierarchical relationship of the represented N levels of user groups. For example, if the identification chain is expressed in big-endian mode, then in order from left to right, the levels of user groups represented by each sub-identification in the identification chain decrease successively. That is, the sub-identification used to represent the user group at the highest level is located at the far left (ie, the front end), and the sub-identity used to represent the user group at the lowest level is located at the far right end (ie, the rear end).
  • the first-level user group represented by the first-level sub-identity may be a user group at the upper level of the second-level user group represented by the second-level sub-identity
  • the second-level user group represented by the second-level sub-identity is represented by a third-level sub-identity The upper-level user group of the third-level user group.
  • the N sub-identities in the user identifier may also be expressed in little-endian mode, which is not limited in this embodiment of the present application. Moreover, if a certain user identity includes N sub-identities, the user identity may be called an N-level user identity or an N-level identity chain.
  • each sub-identity in the identification chain may be the name of the user group it represents, such as the R&D department or the marketing department.
  • each sub-identity may also be the number or code of the user group it represents, and the number or code of the user group may be represented by a numerical value (such as a binary number or a decimal number), and of course other types of characters such as letters may also be used. express.
  • a numerical value such as a binary number or a decimal number
  • the encoding of each user group may be a decimal number.
  • the R&D department in the primary user group is coded 0, the marketing department is coded 1; the design department in the secondary user group is coded 0, the development department is coded 1, the domestic group is coded 0, and the overseas Groups are coded as 1.
  • the user groups to which the second network device of employee Zhang San belongs may include: the hardware design department in the third-level user group, the design department in the second-level user group, and the R&D department in the first-level user group.
  • the user identifier of Zhang San's second network device (that is, the three-level identifier chain) can be expressed as: R&D department. Design department. Hardware design group, or 0.0.0.
  • the level 2 identification chain of Zhang San's second network device can be further determined: R&D department. Design department, or 0.0. Moreover, it is also possible to determine the level 1 identification chain of Zhang San's second network device: R&D department, or 0.
  • the user groups to which the second network devices of employees Wang Wu and Zhao Liu belong can include: the second software development group in the fourth-level user group, the software development group in the third-level user group, and the development department in the second-level user group. , and R&D in the primary user group.
  • the user identifiers of the second network devices of Wang Wu and Zhao Liu (that is, the 4-level identifier chain) can be expressed as: R&D department. Development department. Software development group. Software development group 2, or 0.1.1.1.
  • its level 3 identification chain can be expressed as: R&D department. Development department. Software development group, or 0.1.1.
  • the level 2 identification chain can be expressed as: R&D department. Development department, or 0.1.
  • the level 1 identification chain can be expressed as : R&D department, or 0.
  • the level-3 identification chain of the user group to which the second network device of employee Qian Qi belongs can be expressed as: marketing department.domestic group.3 group, or 1.0.2.
  • the level 2 identification chain of the user group to which the second network device of employee Sun Ba belongs can be expressed as: marketing department.overseas group, or 1.1.
  • identification chains of different levels can indicate user groups of different levels. Or it can be understood as: combinations of different numbers of sub-identities may indicate user groups at different levels. Or it can also be understood as: N sub-identities in an N-level identification chain can form N different sub-identification chains, and the number of sub-identities included in the N sub-identification chains is sequentially from 1 to N, wherein each sub-identification chain Ability to indicate a hierarchy of user groups.
  • the computer resources that can be used to represent the user ID in the device are limited, that is, the number of characters (such as binary digits) occupied by the user ID is fixed or limited.
  • a user ID can be represented by one byte, two bytes or more than two bytes.
  • the user identifier in the coded state that is, the coded state's identifier chain
  • the identification chain of each coding state can be represented by a binary number of two bytes (that is, 16 bits).
  • the coded-state flag chain can be converted into a user state, which can have many different representation.
  • Table 2 for the identification chain of the coding state represented by a 16-bit binary number: 1101 0000 0000 0101, if the division method of Example 1 is used: divide a 4-bit binary number for the first-level sub-identity, and divide it for the second-level sub-identity 5-bit binary number, and divide 7-bit binary number for the third-level sub-identity, then the corresponding user mode identification chain is: 13.0.5.
  • Example 2 If the division method in Example 2 is used: divide 3-digit binary numbers for the first-level sub-identities, second-level sub-identities, and third-level sub-identities, and divide 5-digit binary numbers for the fourth-level sub-identities, then the corresponding user-mode identification chain For: 6.4.0.5.
  • a mask chain may be used to indicate the length of each sub-identity in the identification chain.
  • the mask chain of the N-level identification chain may include N masks, and the N masks are in one-to-one correspondence with the N sub-identities in the N-level identification chain, and each mask is used to indicate the length of a corresponding sub-identification .
  • the length of the sub-identifier refers to the length of the encoding space of the sub-identifier, that is, the size of the storage space occupied by the sub-identifier in the encoded state.
  • the size of the storage space can be represented by the number of bytes or binary digits.
  • the first-level mask in the mask chain can be used to indicate the length of the first-level sub-identification in the identification chain (that is, the binary digits occupied by the first-level sub-identification of the coding state), and the second-level mask can be It is used to indicate the length of the second-level sub-identities in the identification chain; by analogy, the N-level mask can be used to indicate the length of the N-level sub-identities in the identification chain.
  • the identification chain and mask chain of the user mode of each second network device may be expressed as: identification chain/mask chain.
  • "/" represents a delimiter between the identification chain and the mask chain, and the delimiter may also be represented by other symbols, which is not limited in this embodiment of the present application.
  • the mask chain may also be called an N-level mask chain.
  • the representation form of the user state of the N-level mask chain of the N-level identification chain can be:
  • the first-level mask indicates the length of the first-level sub-identities in the N-level identification chain
  • the N-level mask indicates the length of the N-level sub-identities.
  • “:” is the delimiter between the masks. The form of the delimiter is not limited. In addition to “:”, it can also be “.”, “,” or “ ⁇ ”. Moreover, in the embodiment of the present application, for the convenience of description and identification, when a numerical value is used alone to represent a mask, a "/" is prefixed to it to indicate that the numerical value is a mask.
  • the mask refers to the length of the encoding space of the sub-identity, which can be based on the number of sub-identities that need to be distinguished in the level to which the sub-identity belongs, that is, the user groups that need to be distinguished in the user groups of the corresponding level The number (or number of types) is determined. Moreover, the more sub-identities that need to be distinguished in a certain level (that is, the greater the number of user groups that need to be distinguished in the corresponding level), the longer the length of the sub-identities of this level needs to be set. The value of the mask corresponding to the sub-identity of this level is larger.
  • M is greater than Integer of 1.
  • the first-level user group since the first-level user group includes only two user groups, the R&D department and the marketing department, it can be represented by a sub-identifier with a length of 1 (that is, a 1-bit binary number).
  • the code of the research and development department may be 0, and the code of the marketing department may be 1. That is, the sub-identifier used to indicate the research and development department is 0, and the sub-identifier used to indicate the marketing department is 1.
  • the second-level user group since the design department and development department belong to the R&D department, and the domestic group and overseas group belong to the marketing department, the second-level user group can also be represented by a sub-identity with a length of 1.
  • the third-level user group since the first group, the second group and the third user group belong to the domestic group, the third-level user group needs at least a sub-identity with a length of 2 to represent it.
  • group 1 can be coded as 00
  • group 2 can be coded as 01
  • group 3 can be coded as 10.
  • the complete representation of an N-level user ID and its mask chain can be as follows:
  • Second-level sub-identification ....N-level sub-identification/first-level mask: Second-level mask: ...: N-level mask
  • the length of the identification chain (for example, the number of binary digits) is fixed, a mask of a certain level in the mask chain of the user mode can be omitted.
  • the first-level mask or the last-level mask (ie N-level mask) in the mask chain can be omitted.
  • the omitted mask can be obtained through other mask calculations. For example, assuming that the omitted mask is a first-level mask, the representation of an N-level user ID and its mask chain can be as follows:
  • the value of the first-level mask omitted in the mask chain can be calculated by the following formula:
  • Level-1 mask fixed length (eg, 16)-(level-2 mask+level-3 mask+...N-level-1 mask+N-level mask) of the identification chain of the coding state.
  • the complete mask chain representation (that is, the mask chain includes all masks) is used as an example for illustration below.
  • the identification chain of the coding state represented by the binary number is: 1101 0000 0000 0101
  • the mask chain of the identification chain is a 3-level mask chain/2:4:10.
  • Table 4 based on the first-level mask/2 in the third-level mask chain/2:4:10, it can be determined that the length of the first-level sub-identity in the identification chain is 2 bits, and then it can be based on the coded state in the identification chain.
  • the first two bits "00" of the user mode determine that the first-level sub-identity of the user mode is 3.
  • the length of the secondary sub-identity in the identification chain is 4 bits, and then it can be based on the 3rd to 6th bits "0100" in the identification chain in the coded state , it is determined that the second-level sub-identity of the user state is 4.
  • the third-level mask/10 in the mask chain it can be determined that the length of the third-level sub-identity in the identification chain is 10 bits, and then it can be determined based on the last 10 bits "00 0000 0101" in the identification chain in the coded state.
  • the third-level sub-id of user mode is 5. That is, the identity chain of the user mode is 3.4.5.
  • the length of the first-level sub-identity is 2 bits
  • a total of 4 different first-level sub-identities (such as 0-3) can be allocated, that is, there can be at most 4 user groups in the first-level user group .
  • the length of the secondary sub-identity is 4 bits
  • a total of 16 different secondary sub-identities (such as 0-15) can be allocated, that is, there can be at most 16 (ie 2 4 ) user groups in the secondary user group belong to the same primary user group.
  • the length of the third-level sub-identities is 10 bits, a total of 1024 (ie 2 10 ) different third-level sub-identities (such as 0-1023) can be allocated, that is, there can be up to 1024 user groups in the third-level user groups belong to the same secondary user group.
  • the mask chain of the identification chain is a 4-level mask chain/2:2:8:4.
  • the 4-level mask chain/2:2:8:4 it can be determined that the corresponding user mode identification chain is 2.3.255.15.
  • Table 5 it can be seen that since the lengths of the first-level sub-identities and the second-level sub-identities are both 2 bits, a total of 4 different first-level sub-identities can be allocated, and 4 different second-level sub-identities can be allocated. Since the length of the third-level sub-identities is 8 bits, a total of 256 different third-level sub-identities can be allocated. Since the length of the fourth-level sub-identities is 4 bits, 16 different fourth-level sub-identities can be allocated in total.
  • the level 3 user ID and mask chain of the second network device are: 0.0.0/1:1:1.
  • Level 2 user ID and mask chaining is: 0.0/1:1.
  • Level 1 user ID and mask chain is: 0/1.
  • the level 4 user ID and mask chain of the second network device are: 0.1.1.1/1:1:1:1.
  • Level 3 user ID and mask chain is: 0.1.1/1:1:1.
  • Level 2 user ID and mask chaining is: 0.1/1:1.
  • the first-level user ID and mask chain are: 0/1, which is the same as Zhang San's first-level user ID, indicating that Wang Wu and Zhang San belong to the same first-level user group.
  • the level 3 user ID and mask chain of the second network device are: 1.0.2/1:1:2, and so on.
  • the level 2 user ID and mask chain of the second network device are: 1.1/1:1, and so on.
  • the above-mentioned embodiments are all described by using binary numbers to represent the identification chain of the coding state as an example.
  • the binary number can also be equivalent to a decimal number (hereinafter referred to as the equivalent identification).
  • the equivalent identification in addition to the decimal number, it may also be equivalent to other base numbers, such as hexadecimal numbers, which is not limited in this embodiment of the present application.
  • the equivalent identity of the level 3 identity chain 3.4.5 is 53253.
  • the mask chain in the user state can also be converted into an encoding state.
  • the mask chain of this encoding state does not include delimiters, and can be represented by binary numbers.
  • the mask chain of the coding state represented by the binary number may also be equivalent to a decimal number (hereinafter referred to as an equivalent mask for short).
  • the decimal number it may also be equivalent to other base numbers, such as hexadecimal numbers, which is not limited in this embodiment of the present application. Based on this, delimiters can be avoided, further reducing resource or byte count requirements.
  • the method of evenly allocating the number of digits can be used to represent the masks of all levels of the coding state, that is, the lengths of the masks of all levels of the coding state can be equal .
  • the total length of the mask chain of the coding state is 16 bits
  • 4 masks need to be set in the mask chain, and the length of the mask of each coding state can be 4 bits.
  • 8 masks need to be set in the mask chain, and the length of the mask of each coding state can be 2 bits.
  • each mask in the 4-level mask chain/4:4:4:4 can be 4 bits, that is, each mask can be represented by a 4-bit binary number.
  • the encoding state of the 4-level mask chain can be expressed as: 0100 0100 0100 0100, and its equivalent mask is /17476.
  • a method similar to /::X can also be used to simplify the mask chain representing the user mode.
  • /:: indicates that the subsequent numerical value is a mask
  • :: indicates that the masks at all levels are equal
  • X indicates the mask (ie, the length of sub-identities at all levels).
  • /:: indicates that the subsequent numerical value is a mask
  • :: indicates that the masks at all levels are equal
  • X indicates the mask (ie, the length of sub-identities at all levels).
  • 1.1.1.1/::4 can represent a 4-level identification chain, and the masks corresponding to the sub-identities of each level in the 4-level identification chain are all 4, that is, the length of each sub-identity is 4 bits.
  • the lengths of the masks at all levels in the mask chain may also be different. If the lengths of the masks at all levels are different, but they are all fixed lengths, equivalent masks can also be used to represent them. This example can be applied to a communication system in which the lengths of masks of various levels are pre-agreed.
  • the length of the mask chain of the pre-agreed coding state is 16 bits
  • the lengths of the first-level to fourth-level masks in the six-level mask chain are all 2 bits
  • the lengths of the fifth-level and sixth-level masks are both 4 bits.
  • the encoding state of the 6-level mask chain can be expressed as: 1010 1010 0100 0100, and its equivalent mask is /43588.
  • the mask chain when the identification chain of the coding state is transmitted between devices, the mask chain can be transmitted synchronously, so as to ensure that the device (such as the first network device) can identify each stage in the identification chain of the coding state based on the mask chain
  • the sub-identifier is used to determine the hierarchical position of the second network device in the multi-level user group.
  • the mask chain is transmitted synchronously when the identification chain of each coding state is transmitted, the amount of data that needs to be transmitted during the interaction between devices will be increased, and the effect of saving device resources cannot be achieved.
  • the solution provided by the embodiment of the present application can also configure a reference mask chain for multi-level user groups, and the reference mask chain can also be called a unified fixed-length mask, or a unified longest mask.
  • "unified" means that the sub-identities of the same level all use the same mask, that is, the code lengths of the sub-identities of the same level are consistent.
  • each user group in the three-level user group is uniformly encoded with 2-bit binary numbers, instead of using 1-bit binary number encoding for one part and 2-bit binary number encoding for the other part.
  • “Longest” or “fixed length” means that all levels of the multi-level user group are represented, that is, the level of the unified longest mask can be equal to the longest level of the identification chain of the multi-level user group.
  • the maximum level of the multi-level user group is 4 levels, therefore, the number of levels of the unified longest mask is 4, that is, the unified longest mask is a 4-level mask chain.
  • each device in the access control system may be pre-configured with the unified longest mask.
  • the level identifier may be used to indicate the number of levels of the identifier chain, that is, the number of sub-identities included in the identifier chain.
  • the identity chain and hierarchical identity of the user mode can be expressed as: identity chain/identity level. For example, for an N-level identity chain, its user-mode identity chain and level identity can be expressed as:
  • the identifier level "/N" indicates that the identifier chain is an N-level identifier chain, that is, the identifier chain includes N sub-identities.
  • the multi-level user group shown in Figure 7 since except for the three-level user group, other user groups at each level (hereinafter referred to as user groups at all levels) can be coded by a binary number, so other The masks corresponding to the sub-identities of user groups at all levels may all be 1.
  • the third-level user groups although each user group under the Design Department and the Development Department can be coded with a binary number, but because the third-level user group under the domestic group needs to be coded with a two-digit binary number, therefore, According to the configuration principle of the unified longest mask, the three-level user group is uniformly coded with two binary numbers. That is, the mask corresponding to the sub-identity of the third-level user group may be 2.
  • the unified longest mask of the multi-level user group shown in Figure 7 can be /1:1:2:1, that is, the identification chain with a length of 5 (that is, a 5-bit binary number) can represent the mask shown in Figure 7 multi-level user groups shown.
  • Table 10 for the identification chain, level identification and corresponding mask chain of each user group in the multi-level user group shown in FIG. 7 .
  • the length of the identification chain is 5 bits as an example for illustration.
  • x in the binary code in Table 10 may represent a preset invalid binary number, that is, the device may ignore this binary number.
  • the user groups at the smallest level are four-level user groups: software development group 1 and software development group 2.
  • the mask chain corresponding to this four-level user group is the unified longest mask/1:1:2:1.
  • the identification chain, level identification and corresponding mask chain of other user groups at all levels can be:
  • the third-level user group (that is, the hardware design group) to which Zhang San’s second network device belongs, the identification chain and level identification of its user state are 0.0.0/3, where /3 indicates that the identification chain is a third-level identification chain, and its Equivalent ID and level ID can be expressed as 0/3.
  • the device can extract the first 3 levels of masks from the unified longest mask /1:1:2:1, so as to obtain the mask chain /1:1:2 actually corresponding to the level 3 identification chain .
  • the second-level user group i.e. the design department
  • Zhang San’s second network device belongs the identification chain and level identification of its user state are 0.0/2, where /2 indicates that the identification chain is a second-level identification chain, and its equivalent identification And the level identifier can be expressed as 0/2.
  • the device Based on the level identifier/2, the device can extract the first 2-level mask from the unified longest mask /1:1:2:1, so as to obtain the mask chain /1:1 actually corresponding to the 2-level identifier chain.
  • the first-level user group (R&D department) to which Zhang San’s second network device belongs the ID chain and level ID of its user state are 0/1, where /1 means that the ID chain is a first-level ID chain, and its equivalent ID and The level identification can be expressed as 0/1.
  • the device Based on the level identifier /1, the device can extract the first-level mask from the unified longest mask /1:1:2:1, so as to obtain the mask chain /1 actually corresponding to the first-level identifier chain.
  • the fourth-level user group to which Wang Wu’s second network device belongs (that is, the second group of software development)
  • its user-mode identification chain and level identification are 0.1.1.1/4
  • its equivalent identification and level identification can be expressed as 11/4 .
  • the third-level user group (that is, the software development group) to which Wang Wu's second network device belongs has a user mode identification chain and a level identification of 0.1.1/3, and its equivalent identification and level identification can be expressed as 10/4. After the device extracts the first three levels of masks from the unified longest mask/1:1:2:1, it can obtain the mask chain/1:1:2 actually corresponding to the identification chain.
  • the second-level user group (that is, the development department) to which Wang Wu's second network device belongs has an identification chain and a level identification of the user state as 0.1/2, and its equivalent identification and level identification can be expressed as 8/2. After the device extracts the first two levels of masks from the unified longest mask/1:1:2:1, it can obtain the mask chain/1:1 actually corresponding to the identification chain.
  • the first-level user group (that is, the research and development department) to which Wang Wu’s second network device belongs, the identification chain and level identification of its user state are 0/1, and its equivalent identification and level identification can be expressed as 0/1, which is the same as that of Zhang San
  • the identifiers of the first-level user groups are the same, indicating that they belong to the same first-level user group. After the device extracts the first-level mask from the unified longest mask/1:1:2:1, it can obtain the mask chain/1 actually corresponding to the identification chain.
  • the third-level user group (namely, group 3) to which Qianqi's second network device belongs, its user mode identification chain and level identification are 1.0.2/3, and its equivalent identification and level identification can be expressed as 20/3.
  • the device extracts the first three levels of masks from the unified longest mask/1:1:2:1, it can obtain the mask chain/1:1:2 actually corresponding to the identification chain.
  • the secondary user group ie domestic group
  • its user mode ID chain and level ID are 1.0/2
  • its equivalent ID and level ID can be expressed as 16/2.
  • the ID chain and level ID of the user state are 16/1, and the equivalent ID and level ID can be expressed as 1/1.
  • the device extracts the first-level mask from the unified longest mask/1:1:2:1, it can obtain the mask chain/1 actually corresponding to the identification chain.
  • the second-level user group ie, the overseas group
  • Sun Ba's second network device belongs has an identification chain and level identification in user mode as 1.1/2, and its equivalent identification and level identification can be expressed as 24/2.
  • the device extracts the first 2 levels of masks from the unified longest mask /1:1:2:1, the mask chain actually corresponding to the identification chain can be obtained as /1:1;
  • a group of user groups (namely the marketing department) to which Sun Ba’s second network device belongs the ID chain and level ID of its user state are 16/1, and its equivalent ID and level ID can be expressed as 1/1, which is the same as that of Qian Qi
  • the identifiers of the first-level user groups are the same, indicating that they belong to the same first-level user group. After the device extracts the first-level mask from the unified longest mask/1:1:2:1, it can obtain the mask chain/1 actually corresponding to the identification chain.
  • a delimiter can be used to distinguish different sub-identities in the ID chain of the user mode.
  • the third-level user group to which Zhang San's second network device belongs uses the delimiter to represent the ID chain as 0.0.0. Thanks to the separators, the various sub-identities and their hierarchy can be clearly identified.
  • a separator can also be used to distinguish different masks in the mask chain of the user mode. For example, the mask chain/2:2:4 also clearly indicates the masks of all levels and their levels.
  • different combinations of user-mode identification chains and user-mode mask chains can be used according to different usage scenarios. For example, only user-mode identification chains can be used without carrying user-mode mask chains.
  • the identity chain 0.0.0 in user mode can directly represent a level 3 identity chain.
  • a full representation of the identity chain and mask chain can also be used, such as 0.0.0/1:2:3.
  • the identification chain in the coded state since it does not use a separator, it needs to rely on the mask chain (or, unify the longest mask and the level identification) to distinguish the sub-identities of each level included.
  • Table 11 For each level of user group in the multi-level user group shown in FIG. 7 , reference can be made to Table 11 for the identification chain, mask chain and level identification in the user state, and the identification chain and level identification in the encoding state.
  • Table 11 takes binary code as an example to illustrate, and Table 11 also shows the decimal number equivalent to the binary number.
  • the identification chain and level identification of the user state of the three groups in the three-level user group are 1.0.2/3
  • the identification chain and level identification of the encoding state are 10100/00011, which can be expressed as 20 after being equivalent to a decimal number /3.
  • FIG. 8 is a flow chart of another access control method provided by an embodiment of the present application.
  • the access control method can be applied to the system shown in FIG. 1 or FIG. 2 .
  • the access control method includes:
  • Step 201 the controller determines the user identifier and the reference mask chain of each second network device.
  • the user identifier of each second network device can indicate the hierarchical position of the second network device in the multi-level user group, that is, can indicate the user group of each level to which the second network device belongs.
  • network administrators may configure user identifiers for each second network device on the controller based on the hierarchical position of each second network device in the multi-level user group. For example, network administrators can divide each second network device into a multi-level user group, where the multi-level user group includes multiple levels of user groups, and each level of user groups includes one or more user groups. In addition, network administrators can configure a sub-identity for each user group in the multi-level user group.
  • the user identification of each second network device is the ID of the user group at each level to which the second network device belongs. A chain of identities composed of sub-identities.
  • the network manager can also configure the reference mask chain in the controller based on the number of levels included in the multi-level user group and the number of user groups at each level.
  • the reference mask chain may also be called a uniform longest mask or a uniform fixed-length mask.
  • both the user ID and the reference mask chain configured on the controller by the network administrator may be in user mode.
  • the controller may also automatically configure user identities for each second network device based on a pre-stored organizational structure of each second network device and a pre-stored identification configuration rule. Moreover, the controller may automatically generate a reference mask chain based on the number of levels included in the multi-level user group and the number of user groups at each level.
  • the network administrator divides multiple second network devices into four-level user groups, and the second network device of employee Qian Qi belongs to three groups in the third-level user groups, then it can be seen from Figure 6 It is shown that the user ID of the second network device of employee Qian Qi is 1.0.2. Also, the reference mask chain may be /1:1:2:1.
  • Step 202 the controller sends the user identification of each second network device to the authentication server.
  • the controller After the controller acquires the user identifiers of each second network device, the user identifiers can be sent to the authentication server.
  • the controller may convert the user identifier of each second network device from the user state to the coded state, and then send both the user identifiers in the user state and the coded state to the authentication server.
  • the user ID in the user state is used for network administrators to configure access control rules on the authentication server
  • the user ID in the coded state is used for the authentication server to interact with the first network device.
  • the controller when the controller sends the coded user ID to the authentication server, it also needs to send the user ID's mask chain or level ID synchronously.
  • the controller can deliver the mask chain of the coded state or the level identification of the coded state; or, the controller can deliver the coded chain of the coded state and the user state, or the level identification of the coded state and the user state.
  • the controller can convert it to coded state 10100 or 20.
  • the coded user ID and level ID issued by the controller to the authentication server may be 10100/00011, or may be 20/3.
  • Step 203 the controller sends the reference mask chain to the first network device.
  • the controller may also send the reference mask chain in the coding state to the first network device.
  • the controller may convert the reference mask chain of the user state configured by the network administrator into an encoded state, and then send it to the first network device.
  • the controller may convert it into /0001 0001 00100001, or /4385, and send it to the first network device.
  • Step 204 The authentication server generates a third correspondence between user identifiers and hierarchical access control rules based on the hierarchical access control rules configured for user groups at various levels.
  • the network administrator can also configure user groups of at least one level on the authentication server based on the user IDs in the user state.
  • Hierarchical access control rules For example, a network administrator may configure a hierarchical access control rule for each user group of each hierarchy, and a hierarchical access control rule configured for a user group of any hierarchy may include multiple subrules.
  • the authentication server obtains the hierarchical access control rules configured by the network administrator, it can generate a third correspondence between the user ID and the hierarchical access control rules.
  • the user ID recorded in the third correspondence may be a user ID in an encoded state, or may include both a user ID in an encoded state and a user ID in a user state.
  • the third corresponding relationship generated by the authentication server may be as shown in Table 12.
  • the hierarchical access control rule configured by the network administrator for the R&D department (ie, user ID 0) in the first-level user group is R1
  • Control rules include two sub-rules R4 and R5.
  • the network administrator does not configure hierarchical access control rules.
  • Step 205 the authentication server sends the third correspondence to the first network device.
  • the authentication server After the authentication server generates the third correspondence, it can deliver the third correspondence to the first network device. For example, the authentication server may issue the third correspondence shown in Table 12 to the first network device.
  • step 204 and step 205 may also be executed by the controller. That is, the controller may generate the third correspondence and deliver the third correspondence to the first network device.
  • the controller may generate the third correspondence and deliver the third correspondence to the first network device.
  • the third network device may be an authentication server or a controller.
  • Step 206 the second network device sends an authentication packet to the first network device.
  • each second network device may first send an authentication message to the first network device when accessing the network, and the authentication message carries access authentication information of the second network device.
  • the access authentication information may include the user name and password of the second network device.
  • Step 207 the first network device reports access authentication information to the authentication server.
  • the first network device may report the access authentication information in the authentication message to the authentication server for authentication by the authentication server.
  • Step 208 If the authentication server determines that the second network device has passed the authentication, it determines the target user identifier of the second network device based on the access authentication information.
  • the authentication server may authenticate the access authentication information. If the authentication server determines that the access authentication information is authenticated (that is, the second network device is authenticated), it may determine the target user identifier of the second network device based on the pre-stored correspondence between the access authentication information and the user identifier. Wherein, the user name of the second network device and the corresponding user ID may be recorded in the corresponding relationship between the access authentication information and the user ID.
  • the authentication server may obtain the user name in the access authentication information, and obtain the pre-stored password corresponding to the user name. Afterwards, the authentication server can detect whether the password in the access authentication information is the same as the pre-stored password, and if they are the same, the authentication server can determine that the second network device has passed the authentication, and obtain the target user identifier of the second network device. If the authentication server determines that the authentication of the second network device fails, it may feed back the first prompt information of authentication failure to the first network device. The first network device can then forward the first prompt information to the second network device, so that the second network device can report the access authentication information again.
  • the authentication server may also determine the level ID of the target user ID, or the target mask chain of the target user ID.
  • Step 209 the authentication server issues the target user identifier of the second network device to the first network device.
  • the authentication server After the authentication server acquires the target user ID of the second network device, it can issue the target user ID to the first network device.
  • the authentication server may deliver the target user ID and layer ID of the second network device to the first network device, or deliver the target user ID and target mask chain of the second network device.
  • the first network device reports the access authentication information of the second network device of employee Qian Qi to the authentication server, and the authentication server can obtain the second network device of employee Qian Qi after confirming that the access authentication information passes the authentication.
  • the target user ID and level ID 20/3, or 10100/00011, and send it to the first network device.
  • the authentication server may also send the second prompt information of passing the authentication to the first network device, and the first network device may forward the second prompt information to the second network device, and the second network device may forward the second prompt information to the second network device.
  • the network device can then send a service packet to the first network device to access the network.
  • Step 210 the first network device records the first correspondence between the message ID and the target user ID.
  • the authentication message sent by the second network device carries the message identifier.
  • the first network device may record a first correspondence between the message ID of the authentication message and the target user ID.
  • the first correspondence may also record a target user identifier's hierarchical identifier or a target mask chain.
  • the message identifier may be part or all of the information in the five-tuple information of the message, or may be part or all of the information in the seven-tuple information.
  • Step 211 the first network device determines at least one hierarchical access control rule corresponding to the target user identifier based on the third correspondence.
  • the first network device may acquire the target mask chain of the target user ID.
  • the target mask chain includes at least one mask corresponding to at least one sub-identity included in the target user identification, and each mask is used to indicate the length of a corresponding sub-identity. Then, the first network device may determine at least one sub-identity included in the target user identifier based on at least one mask in the target mask chain.
  • the first network device can determine the identity chain (that is, the identity chain in the user mode) based on the target user identity and the target mask chain, the identity chain includes at least one sub-identity, and the identity chain can indicate the second network The hierarchical position of the device in the multi-level user group.
  • the at least one sub-identity is in one-to-one correspondence with at least one level of user groups to which the second network device belongs, wherein each sub-identity may be a code of a corresponding level of user groups.
  • the first network device may determine an access control rule for performing access control on the service packets sent by the second network device.
  • the access control rule includes at least one hierarchical access control rule, that is, one hierarchical access control rule or multiple hierarchical access control rules.
  • the target user identifier may include multiple sub-identities.
  • the first network device may first determine multiple sub-identity chains that can be formed by the multiple sub-identities.
  • each sub-identity chain includes one sub-identity or multiple consecutive sub-identities, the number of sub-identities included in different sub-identity chains is different, and each sub-identity chain can indicate a level of user group.
  • the multiple sub-identities can form multiple user identities of different levels.
  • the identification chain of a certain level determined by the first network device based on the target user identification and the target mask chain may include multiple identification chains of different levels.
  • the first network device can determine a hierarchical access control rule corresponding to each sub-identity chain composed of multiple sub-identities (that is, each user identity composed of multiple sub-identities), so that Multiple levels of access control rules.
  • the first network device may sequentially combine different numbers of sub-identities in the identification chain according to a preset order, so as to obtain multiple sub-identification chains of different lengths.
  • the preset order may be a left-to-right order, or a right-to-left order.
  • the target mask chain of the target user identifier may be directly delivered to the first network device by the authentication server. That is to say, the first network device may receive the target mask chain delivered by the authentication server, and determine the identity chain based on the target mask chain and the target user ID, that is, determine each sub-chain included in the target user ID based on the target mask chain. logo.
  • the authentication server may deliver the level identifier of the target user identifier to the first network device.
  • the first network device may first determine the target mask chain from the pre-stored reference mask chains based on the layer identifier. Thereafter, an identification chain can be determined based on the target mask chain and the target user identification.
  • the level identifier is used to indicate the number of sub-identities included in the identifier chain
  • the reference mask chain includes multiple masks
  • the number of masks included in the reference mask chain is greater than or equal to the number of masks included in the identifier chain The number of sub-ids.
  • the first network device may extract the previous target number of masks from the reference mask chain in a preset order, so as to obtain the target mask chain.
  • the target quantity is the number of sub-identities included in the target user identifier indicated by the level identifier.
  • the preset order may be a left-to-right order, or a right-to-left order.
  • the first network device can determine the target user based on the level ID 00011 Identified as a Level 3 User Identifier. Furthermore, the first network device may extract the first three masks (that is, the first three levels of masks) from the reference mask chain 1:1:2:1 to obtain the target mask chain 1:1:2.
  • the first-level mask/1 in the target mask chain indicates that the length of the first-level sub-identity in the target user ID is 1, so the first network device can determine the first bit "1" in the target user ID 10100 " is the first-level sub-identity.
  • the second-level mask/1 in the target mask chain indicates that the length of the second-level sub-identity in the target user ID is 1, so the first network device can determine that the second bit "0" in the target user ID 10100 is two class subid.
  • the third-level mask 2 in the target mask chain indicates that the length of the third-level sub-identity in the target user ID is /2, so the first network device can determine the third and fourth digits "10" in the target user ID 10100 " is the third-level sub-identity, that is, the third-level sub-identity is 2. Since the target mask chain 1:1:2 can indicate that the effective length of the target user ID is 4, the first network device can determine that the last bit "0" of the target user ID is an invalid bit, and can ignore the last bit .
  • the first network device can determine that the three sub-identities included in the target user ID 10100 are 1, 0 and 2 in sequence, that is, it can determine that the ID chain in the user mode is 1.0.2.
  • the first network device can further determine that the three sub-identities can form a third-level sub-identity chain 1.0.2, can also form a second-level sub-identity chain 1.0, and can also form a first-level sub-identity chain 1. That is, the three sub-identities can form three sub-identification chains of different lengths, that is, three different levels of user identifications.
  • the first network device can determine that the hierarchical access control rule of the third-level user group corresponding to the third-level sub-identity chain 1.0.2 is R12, and the second-level sub-identity chain 1.0 corresponds to
  • the hierarchical access control rules of the second-level user group include R4 and R5, and the hierarchical access control rule of the first-level user group corresponding to the first-level sub-identity chain 1 is R2.
  • Step 212 Based on the first correspondence and the at least one hierarchical access control rule, the first network device records a second correspondence between the packet identifier and the at least one hierarchical access control rule.
  • the first network device After determining at least one hierarchical access control rule indicated by the target user identifier, the first network device can record a second correspondence between the packet identifier and the at least one hierarchical access control rule. Therefore, after the first network device subsequently receives the service message sent by the second network device, it can directly obtain at least one corresponding level access control rule from the second correspondence based on the message identifier of the service message , and perform access control on service packets based on at least one obtained hierarchical access control rule. That is, the first network device does not need to first determine the target user ID of the second network device every time it receives a service packet sent by the second network device, and identify each sub-identity included in the target user ID. Thus, the efficiency of access control on service packets is effectively improved.
  • the second correspondence recorded by the first network device may include: message Identify 192.168.x.x, and the corresponding hierarchical access control rules as follows: hierarchical access control rule R12 for the third-level user group, hierarchical access control rules R4 and R5 for the second-level user group, and hierarchical access control rule R2 for the first-level user group.
  • hierarchical access control rule R12 for the third-level user group
  • hierarchical access control rules R4 and R5 for the second-level user group
  • hierarchical access control rule R2 for the first-level user group.
  • the above steps 209 to 212 are described by taking the authentication server issuing the target user identifier of the second network device as an example. It can be understood that, in the above step 209, the authentication server may also issue the target user identifier and at least one hierarchical access control rule. Correspondingly, after receiving the information sent by the authentication server, the first network device can directly record the second corresponding relationship between the packet identifier and the at least one hierarchical access control rule.
  • the authentication server may only issue at least one hierarchical access control rule without issuing the target user identifier of the second network device.
  • the first network device may also not need to execute the method shown in step 210 above, but may directly record the second correspondence based on at least one hierarchical access control rule issued by the authentication server.
  • Step 213 the second network device sends the service packet to the first network device.
  • the second network device after the second network device determines that its access authentication information is authenticated, it can send a service packet to the first network device to access the network.
  • the service message carries a message identifier, and the message identifier is the same as the message identifier in the authentication message sent by the second network device.
  • Step 214 the first network device determines at least one hierarchical access control rule corresponding to the packet identifier of the service packet from the second correspondence.
  • the first network device may acquire the packet identifier in the service packet. Furthermore, at least one hierarchical access control rule corresponding to the packet identifier may be determined from the second correspondence. For example, assuming that the message identifier of the service message is 192.168.x.x, the first network device can determine from the second correspondence that the hierarchical access control rules corresponding to the message identifier include: the hierarchical access control rules of the third-level user group R12, the hierarchical access control rules R4 and R5 of the second-level user group, and the hierarchical access control rule R2 of the first-level user group.
  • Step 215 the first network device performs access control on the service packet based on the at least one hierarchical access control rule.
  • the first network device may perform access control on the service packets sent by the second network device based on at least one determined hierarchical access control rule. That is, service packets can be forwarded or discarded based on the at least one hierarchical access control rule.
  • the first network device may also send the access control result to the second network device or other devices (such as a controller).
  • the access control result may include the access control rules applied to the service message.
  • the above step 212 is described as an example where the first network device determines the user groups of each level to which the second network device belongs based on the target user identifier, and then determines the level access control rules corresponding to the user groups of each level. It can be understood that if the second network device belongs to multiple user groups of different levels (that is, the number of levels of target user identification is greater than 1), then in step 212, the first network device can also select from the user groups of multiple different levels. Determine at least one level of target user group in the group, and determine at least one level access control rule corresponding to the at least one level of target user group.
  • the first network device may determine a corresponding first-level access control rule based on the first-level user group.
  • the at least one level access control rule includes the first level access control rule.
  • the first network device can perform the first access control on the service packet sent by the second network device based on the first-level access control rule.
  • the first network device may determine based on the target user ID that the second network device respectively belongs to three groups in the third-level user group, a domestic group in the second-level user group, and the marketing department in the primary user group. If the target user group of at least one level determined by the first network device from the three different levels of user groups includes three groups of three-level user groups (that is, the first-level user group is three groups), then the first network device Based on the third correspondence shown in Table 12, it can be determined that the three sets of corresponding first-level access control rules are R12. Furthermore, the first network device may perform the first access control on the service packets sent by the second network device based on the hierarchical access control rule R12.
  • the target user group of at least one level may be determined by the first network device based on a pre-configured rule.
  • the target user group of at least one level may be a user group of at least one level with the highest level or the lowest level among the user groups of various levels to which the second network device belongs.
  • the target user group of at least one level may be a user group of a specified level pre-configured in the first network device.
  • the at least one level of target user groups may further include a second level of user groups, where the second level of user groups is a superior user group of the first level of user groups.
  • the upper-level user group may be a user group at any level higher than the first-level user group.
  • the second-level user group may be a second-level user group or a first-level user group.
  • the first network device can also determine a corresponding second-level access control rule based on the second-level user group, and the at least one level access control rule also includes the second-level access control rule.
  • the first network device may also perform second access control on the service packets sent by the second network device based on the second-level access control rule.
  • the second access control may be performed before or after the first access control. That is to say, the first network device may sequentially execute the hierarchical access control rules corresponding to the target user groups of each hierarchical level in descending order of hierarchical levels, or in the order of descending hierarchical levels.
  • the first network device may determine that the second-level access control rules corresponding to the second-level user group include R4 and R5 based on the third correspondence shown in Table 12. Furthermore, the first network device may perform second access control on the service packets sent by the second network device based on the hierarchical access control rules R4 and R5. In addition, the first network device may execute the hierarchical access control rules R4 and R5 after executing the hierarchical access control rule R12. Alternatively, the first network device may execute the hierarchical access control rules R4 and R5 first, and then execute the hierarchical access control rule R12.
  • the at least one level of target user groups includes a first-level user group and a second-level user group, and the second-level user group is an upper-level user group of the first-level user group.
  • the first network device may base on the hierarchical access control rules corresponding to the second-level user group A rule is used to perform access control on the service packets sent by the second network device.
  • the network administrator may not configure corresponding level access control rules for the part of level user groups.
  • the first network device does not obtain the hierarchical access control rules corresponding to the first-level user group to which the second network device belongs, based on the hierarchical access control rules corresponding to the upper-level user groups of the first-level user group, Perform access control on the service packets sent by the second network device.
  • flexible control over the service packets sent by the second network device is realized, and network security is effectively ensured.
  • the target user identifier of the user mode determined by the first network device is 0.1.0. If the first-level user group determined by the first network device based on the target user ID 0.1.0 is the development department in the second-level user group (the second-level user ID is 0.1), the second-level user group is the first-level user group R&D department of (level 1 user ID 0). Then, based on the third correspondence shown in Table 12, it can be seen that the third correspondence does not record the hierarchical access control rules corresponding to the first-level user groups. Thus, the first network device can acquire and execute the hierarchical access control rule R1 corresponding to the research and development department in the first-level user group.
  • the first network device performs access control on the service packets sent by the second network device based on the layer access control rules corresponding to the user groups of each layer to which the second network device belongs in order of the layers from low to high.
  • the implementation process of the access control may include the following steps:
  • the first network device may first determine the level access control rules of the n-level user groups corresponding to the n-level user IDs (that is, the n-level ID chains).
  • the first network device may determine that the hierarchical access control rule of the third-level user group is R12.
  • the first network device may perform access control on the service packets sent by the second network device based on the hierarchical access control rule R12 of the three-level user group.
  • the first network device After the first network device executes the hierarchical access control rules of the n-level user group on the service packets, it can update n to n-1, so as to continue to acquire and execute the hierarchical access control rules of the upper-level user group.
  • the first network device may determine a level-2 sub-identity chain from the target user identity 1.0.2, that is, the level-2 user identity 1.0. Afterwards, the first network device may acquire and execute the hierarchical access control rules R4 and R5 of the secondary user group indicated by the secondary user identifier 1.0. After executing the hierarchical access control rules R4 and R5, the first network device can update n to 1, and can determine the level 1 sub-identity chain from the target user identity 1.0.2, that is, the level 1 user identity 1. Afterwards, the first network device may acquire and execute the hierarchical access control rule R2 of the first-level user group indicated by the first-level user ID 1 .
  • the first network device performs access control on the service packets sent by the second network device based on the hierarchical access control rules of the user groups of each level to which the second network device belongs in order of the hierarchy from high to low.
  • the implementation process of the access control may include the following steps:
  • the first network device can determine the first-level user ID 1 from the target user ID 1.0.2, and then determine the first-level user ID 1
  • the hierarchical access control rule of the indicated first-level user group is R2.
  • the first network device may execute the hierarchical access control rule R2 on the service packets sent by the second network device.
  • step S23 to step S25 can be continued to obtain and execute the hierarchical access control rules of the user group at the next level.
  • the first network device may continue to acquire and execute the hierarchical access control rules R4 and R5 of the secondary user group indicated by the secondary user identifier 1.0. Afterwards, the first network device may update m to 3, and continue to acquire and execute the hierarchical access control rule R12 of the third-level user group indicated by the third-level user identifier 1.0.2.
  • the first network device implements access control on the service packets sent by the second network device based on the hierarchical access control rules of at least one target user group in order of the hierarchy from low to high.
  • the target user group of at least one level refers to some user groups in the user groups of each level to which the second network device belongs. That is, the first network device may perform access control on the second network device based on the hierarchical access control rules of the partial hierarchical user groups to which the second network device belongs.
  • the target user group of at least one level may be preselected and configured in the first network device. For example, it may be configured by a network administrator in the first network device, or may be delivered to the first network device by a controller or an authentication server.
  • the at least one level of target user group may be any level of user group in the n-level user groups to which the second network device belongs; or, the at least one level of target user group may include n-level user groups with levels less than equal to m user groups; or, the at least one level of target user groups may include n-level user groups whose levels are greater than or equal to m; or, the at least one level of target user groups may include n-level user groups A user group whose level is greater than or equal to m1 and less than or equal to m2; or, the target user group of at least one level may be the first network device according to the order of the level from high to low or from low to high, from the level of the n-level user group The user group that obtains the access control rule
  • the implementation process for the first network device to perform access control on the service packets sent by the second network device may include the following steps:
  • the first network device can first determine at least one level of the target user group The highest level of m. That is, the first network device may first determine the level m to be executed. For example, referring to FIG. 11 , the highest level m may be equal to two.
  • the first network device may determine that the hierarchical access control rule of the third-level user group is R12.
  • the first network device may execute the access control rule R12 on the service packets sent by the second network device.
  • the target user group of at least one level is the user group for which the first network device first obtains the corresponding level access control rules from the level access control rules of the n level user groups according to the order of levels from low to high.
  • the implementation process of the first network device performing access control on the service message sent by the second network device may include the following steps:
  • the first network device may first determine the level access control rules of the n-level user groups corresponding to the n-level user IDs (that is, the n-level ID chains).
  • the first network device can continue to perform step S44; if the hierarchical access control rules of the n-level user group are not obtained successfully, that is, the n-level user is not configured in the first network device If the hierarchical access control rule of the group is not specified, the first network device may continue to perform step S45.
  • network administrators can only configure hierarchical access control rules for user groups at some levels, for example, they can only configure hierarchical access control rules for first-level, second-level, and third-level user groups , without configuring hierarchical access control rules for four-level user groups. Or, network administrators can only configure hierarchical access control rules for some user groups at a certain level. For example, for the second-level user groups, you can only configure hierarchical access control rules for The development department configures hierarchical access control rules. Based on this, there may be situations where the first network device fails to obtain the hierarchical access control rules of the user group at a certain level.
  • the first network device After the first network device obtains the hierarchical access control rule of the n-level user group, it can perform access control on the service packets sent by the second network device based on the hierarchical access control rule. Moreover, after step S44, the first network device can end the access control operation. That is to say, the first network device can end the operation after obtaining the hierarchical access control rule corresponding to any hierarchical user group and executing the hierarchical access control rule, without traversing and executing the hierarchical access control rules corresponding to other hierarchical user groups. Access control rules.
  • n may be updated to n-1, so as to continue to obtain the hierarchical access control rules corresponding to the user groups at the upper level.
  • n may be updated to 1 because the first network device has not obtained the hierarchical access control rules of the 2-level user group.
  • the first network device may continue to execute S42, and obtain the hierarchical access control rule R1 of the first-level user group indicated by the user ID 0. Afterwards, after the first network device executes the level access control rule R1 on the service packets, the operation can be ended.
  • the access control system may also include multiple first network devices, and the multiple first network devices may be located at different levels in the access control system.
  • the controller may issue the reference mask chain to each first network device respectively.
  • the multiple first network devices include access layer device 01a and core layer device 01b
  • the controller may send the coded reference mask chains to the access layer device 01a respectively and core layer device 01b.
  • the authentication server may issue the third corresponding relationship to each first network device respectively, that is, each first network device can receive the third corresponding relationship.
  • the authentication server may issue the user identifiers and corresponding hierarchical access control rules of the corresponding user groups in the third correspondence to the first network device based on the hierarchical position of each first network device in the access control system, That is, each first network device may receive part of the third correspondence.
  • the authentication server may divide the multi-level user group into several hierarchical ranges based on the hierarchical position of each first network device in the access control system.
  • Each layer range includes one layer or multiple consecutive layers, each first network device corresponds to a layer range, and different first network devices correspond to different layer ranges.
  • the authentication server may deliver the user identifier corresponding to the hierarchical range and the corresponding hierarchical access control rule to each first network device.
  • each first network device may belong to a multi-level user group.
  • the authentication server may determine the level range to which the level of the first network device belongs as the level range corresponding to the first network device.
  • the authentication server can use the four-level user group as shown in FIG. 6 or FIG. 7 User groups are divided into two hierarchical ranges.
  • the first level range includes the first level user group
  • the second level range includes the second level user group, the third level user group and the fourth level user group.
  • the authentication server can issue the user ID of the first level range and the corresponding level access control rules to the first network device of the first level user group, that is, the user ID of the first level user group and the level access control rules corresponding to the first level user group .
  • the authentication server may issue the user identification and access control rules of the second level to the first network device of the third-level user group, that is, the user identification and access control rules of the second-level user group, third-level user group, and fourth-level user group. Corresponding hierarchical access control rules.
  • the first network device of the secondary user group may be based on the levels of the secondary user group, the third user group and the fourth user group
  • the access control rules perform access control on the service packets sent by the second network device.
  • the first network device of the first-level user group can perform access control on the service packets sent by the second network device based on the hierarchical access control rules of the first-level user group.
  • the authentication server may determine the layer corresponding to each first network device based on the layer position of each first network device in the access network (for example, access layer, aggregation layer, or core layer, etc.) scope.
  • the authentication server can determine the first level range (such as a primary user group and a secondary user group) Corresponding to the core layer device 01b, the second level range (for example, the third-level user group and the fourth-level user group) corresponds to the access layer device 01a.
  • the authentication server can issue the user ID of the first level range and the corresponding level access control rules to the core layer device 01b, and issue the user ID of the second level range and the corresponding level access control rules to the access layer device 01a. control rules.
  • the access control method provided by the embodiment of the present application is introduced by taking the first network device in the access control system including the core layer device 01b and the access layer device 01a as an example. As shown in Figure 13, the method may include the following steps:
  • the third network device delivers the user identification of the first level range and the corresponding level access control rule to the core layer device.
  • the third network device may be a controller or an authentication server.
  • the first level range may include a higher level in the multi-level user group, for example, may include a first-level user group and a second-level user group.
  • the third network device delivers the user identifier of the second level range and the corresponding level access control rule to the access layer device.
  • the second level range may include a lower level in the multi-level user group, for example, may include a third-level user group and a fourth-level user group.
  • Step 303 the second network device sends an authentication packet to the access layer device.
  • the authentication message carries access authentication information.
  • Step 304 the access layer device reports access authentication information to the authentication server.
  • the authentication server may authenticate the access authentication information.
  • Step 305 the access layer device receives the target user identifier of the second network device sent by the authentication server.
  • the authentication server may send the target user identifier of the second network device to the access layer device. For example, the authentication server may send the target user ID and the level ID, or send the target user ID and the target mask chain.
  • Step 306 the core layer device receives the first correspondence between the packet identifier and the target user identifier sent by the authentication server.
  • the authentication server may also record the first correspondence between the message identifier of the authentication message and the target user identifier of the second network device, and send the first correspondence to the core layer equipment. That is, the authentication server can bind the packet identifier with the target user identifier. Wherein, the packet identifier may be obtained by the authentication server from the authentication packet. It can be understood that, the first correspondence sent by the authentication server to the core layer may also record the level identifier of the target user identifier, or the target mask chain.
  • Step 307 the access layer device determines at least one layer access control rule corresponding to the target user identifier.
  • the access layer device After the access layer device receives the target user ID sent by the authentication server, it can determine that at least one level access control rule corresponding to the target user ID is the level of the second level range based on the target user ID and the target mask chain Access control rules. Afterwards, the access layer device may record the correspondence between the packet identifier and the layer access control rule of the second layer range.
  • Step 308 the second network device sends the service packet to the access layer device.
  • the access layer device performs access control on the service packets based on the layer access control rules in the second layer range.
  • the access layer device After the access layer device receives the service message sent by the second network device, it can perform access control on the service message based on the hierarchical access control rules in the scope of the second level. For example, the access layer device may determine the layer access control rule of the second layer range based on the message identifier of the service message, and determine the layer access control rule of the second layer range based on the determined layer access control rule of the second layer range. Perform access control.
  • Step 310 the access layer device forwards the service message to the core layer device.
  • Step 311 the core layer device determines the corresponding target user identifier based on the packet identifier of the service packet.
  • the core layer device After receiving the service packet forwarded by the access layer device, the core layer device can query the first correspondence issued by the authentication server based on the message identifier of the service packet, so as to obtain the target user identifier of the second network device.
  • Step 312 the core layer device performs access control on the service packets based on the hierarchical access control rules in the first hierarchical range.
  • the core layer device After the core layer device determines the target user ID, based on the target user ID and the target mask chain, it can determine the hierarchical access control rule of the first hierarchical range. Afterwards, the core layer device can perform access control on the service message based on the layer access control rules in the first layer range.
  • the core layer device may also base the first correspondence on the basis of the first correspondence issued by the third network device. range of user identifiers and corresponding hierarchical access control rules, and generate a correspondence between message identifiers and hierarchical access control rules of the first hierarchical range.
  • the core layer device can adopt the layer access control rule of the first layer range based on the correspondence between the packet identifier and the layer access control rule of the first layer range. Access control rules implement access control on service packets.
  • the third network device can send user IDs of different levels and corresponding level access control rules to the first network devices of different levels
  • the first network devices of different levels can perform level access of different level ranges control rules. That is to say, the method provided by the embodiment of the present application realizes hierarchical or partitioned management and control of the second network device, can meet various differentiated security management and control requirements, and effectively improves the flexibility of management and control.
  • the service packet forwarded by the access layer device to the core layer device may also carry the identification information of the second network device, and the identification information may include a target user ID and a layer ID, or include a target user ID and target mask chain.
  • the core layer device can directly obtain the identification information from the service message, and determine the corresponding layer access control rule based on the identification information.
  • the core layer device does not need to execute the method shown in step 306 above, that is, the authentication server does not need to deliver the first correspondence between the message ID and the target user ID to the core layer device.
  • step 203 in the above embodiment shown in FIG. 8 may be performed before step 202; or, step 210 may be deleted according to circumstances.
  • step 302 in the above embodiment shown in FIG. 13 may be performed before step 301, or step 307 may be performed before step 306, or step 306 may be deleted according to circumstances.
  • the embodiment of the present application provides an access control method. Since the target user identifier of the second network device can indicate the hierarchical position of the second network device in the multi-level user group, the first network device can be based on The target user identifier of the second network device determines at least one hierarchical access control rule corresponding to at least one hierarchical user group. Thus, based on the determined at least one hierarchical access control rule, the first network device can perform precise access control on the service packets sent by the second network device. During the access control process, since the first network device can determine one or more hierarchical access control rules based on a target user identifier, flexible and efficient access control on service packets is realized.
  • the second network device belongs to user groups of multiple levels
  • after the authentication server performs access authentication on the second network device it only needs to issue a target user ID to the first network device to realize multi-level authentication.
  • the transfer of identity chains ie, user identities
  • the method provided by the embodiment of the present application effectively reduces the number of interactions between the authentication server (or controller) and the first network device.
  • the amount of interactive data simplifies the interaction process, improves the efficiency of interaction, and then improves the efficiency of access control.
  • Fig. 14 is a schematic structural diagram of a first network device provided by an embodiment of the present application.
  • the first network device can be applied to the system shown in Fig. 1 or Fig. 2, and can implement the first network The steps performed by the device.
  • the first network device includes:
  • the determining module 011 is configured to determine a target user identifier of the second network device, where the target user identifier indicates the hierarchical position of the second network device in the multi-level user group, where the multi-level user group includes multiple levels of user groups.
  • the determination module 011 For the function implementation of the determination module 011, reference may be made to the relevant description of step 101 in the above method embodiment.
  • the determining module 011 is further configured to determine at least one hierarchical access control rule based on the target user identifier, and the at least one hierarchical access control rule is in one-to-one correspondence with at least one hierarchical user group in the multi-level user group.
  • the determining module 011 For the function implementation of the determining module 011, reference may also be made to the relevant description of step 102 in the above method embodiment.
  • the access control module 012 is configured to perform access control on the service packets sent by the second network device based on at least one hierarchical access control rule.
  • access control module 012 For the function implementation of the access control module 012, reference may be made to the relevant description of step 103 in the above method embodiment.
  • the determination module 011 can be used for:
  • the access control module 012 may be configured to perform first access control on the service packets sent by the second network device based on the first-level access control rules.
  • the function realization of the access control module 012 can also refer to the related description of step 215 in the method embodiment shown in FIG. 8 .
  • the target user group of the at least one level also includes a second-level user group, and the second-level user group is a superior user group of the first-level user group; the determination module 011 can also be used for:
  • a corresponding second-level access control rule is determined, and the at least one level access control rule includes the second-level access control rule.
  • the access control module 012 can also be configured to perform second access control on the service packets sent by the second network device based on the second-level access control rule; wherein, the second access control is performed before the first access control or Execute afterwards.
  • the determining module 011 can be used for:
  • At least one level of target user group is determined, the at least one level of target user group includes a first-level user group and a second-level user group, and the second-level user group is the superior of the first-level user group user group;
  • the access control module 012 can be used for:
  • access control is performed on the service packets sent by the second network device based on the hierarchical access control rule corresponding to the second-level user group.
  • the determination module 011 can be used for:
  • An identification chain is determined based on the target user identification and the target mask chain, the identification chain includes at least one sub-identity, the identification chain indicates the hierarchical position of the second network device in the multi-level user group, and the at least one sub-identity is related to at least One-to-one correspondence between user groups at a level;
  • the target mask chain includes at least one mask corresponding to at least one sub-identity, and each mask is used to indicate a corresponding sub-identity length.
  • the identification chain includes multiple sub-identities; the determining module 011 may be used to:
  • each sub-identification chain includes one sub-identification or multiple consecutive sub-identifications, different sub-identification chains include different numbers of sub-identifications, and each sub-identification chain indicates a Hierarchical user groups; determining a hierarchical access control rule corresponding to a hierarchical user group indicated by each sub-identification chain.
  • the first network device may also include:
  • the receiving module 013 is configured to receive the target mask chain issued by the authentication server before the determining module 011 determines at least one hierarchical access control rule based on the target user identification; or receive the hierarchical identification of the target user identification issued by the authentication server, and determining the target mask chain from the reference mask chain based on the hierarchical identification;
  • the level identifier is used to indicate the number of sub-identities included in the identification chain
  • the reference mask chain includes multiple masks
  • the number of masks included in the reference mask chain is greater than or equal to the number of sub-identities included in the identification chain number
  • step 209 and step 211 in the above method embodiments.
  • the first network device may also include:
  • the sending module 014 is configured to report the access authentication information of the second network device to the authentication server.
  • the sending module 014 reference may be made to the relevant descriptions of steps 206, 207, and 304 in the above method embodiments.
  • the receiving module 013 is further configured to receive the target user ID of the second network device issued by the authentication server, where the target user ID is issued by the authentication server after determining that the access authentication information is authenticated.
  • the determination module 011 can also be used for:
  • the receiving module 013 After the receiving module 013 receives the target user identifier of the second network device issued by the authentication server, it records the first corresponding relationship between the message identifier and the target user identifier, and the message identifier is identified by the message sent by the second network device. carry;
  • a second correspondence between the packet identifier and the at least one hierarchical access control rule is recorded.
  • the access control module 012 can be used for:
  • step 214 For the function implementation of the access control module 012, reference may also be made to the relevant description of step 214 in the above method embodiment.
  • the receiving module 013 may also be configured to receive the first correspondence between the message identifier and the target user identifier issued by the authentication server.
  • the receiving module 013 reference may also be made to the relevant description of step 306 in the above method embodiment.
  • the determining module 011 is configured to determine the target user identifier of the second network device from the first correspondence based on the message identifier of the service packet after receiving the service message sent by the second network device.
  • determination module 011 For the function implementation of the determination module 011, reference may also be made to the relevant description of step 311 in the above method embodiment.
  • the determining module 011 may be configured to: determine at least one hierarchical access control rule corresponding to the target user identifier based on a third correspondence between the user identifier and the hierarchical access control rule.
  • step 211 For the function implementation of the determining module 011, reference may also be made to the relevant description of step 211 in the above method embodiment.
  • the receiving module 013 is further configured to receive a third correspondence between user IDs and hierarchical access control rules issued by the third network device before the determining module 011 determines at least one hierarchical access control rule based on the target user ID.
  • step 205 For the function implementation of the receiving module 013, reference may also be made to the relevant descriptions of step 205, step 301 and step 302 in the above method embodiments.
  • the target user identifier includes: a first-level sub-identity and a second-level sub-identity;
  • the first-level sub-identity is used to indicate a first-level user group in at least one level of user groups
  • the combination of the first-level sub-identity and the second-level sub-identity is used to indicate a second-level user group in at least one level of user groups
  • the first-level user group is a user group at the upper level of the second-level user group.
  • the target user identifier also includes: a third-level sub-identity
  • the combination of the first-level sub-identity, the second-level sub-identity and the third-level sub-identity is used to indicate a third-level user group in at least one level of user groups, and the second-level user group is a user group of the upper level of the third-level user group .
  • the first network device belongs to a primary user group, and the second network device belongs to a secondary user group;
  • the access control module 012 is configured to perform access control on the service packets sent by the second network device based on the hierarchical access control rules corresponding to the first-level user groups.
  • access control module 012 For the function implementation of the access control module 012, reference may also be made to the relevant descriptions of steps 309 and 312 in the above method embodiments.
  • the embodiment of the present application provides a first network device. Since the target user identifier of the second network device can indicate the hierarchical position of the second network device in the multi-level user group, the first network device can Based on the target user identifier of the second network device, at least one hierarchical access control rule corresponding to at least one hierarchical user group is determined. Thus, based on the determined at least one hierarchical access control rule, the first network device can perform precise access control on the service packets sent by the second network device. During the access control process, since the first network device can determine one or more hierarchical access control rules based on a target user identifier, flexible and efficient access control on service packets is realized.
  • FIG. 16 is a schematic structural diagram of an authentication server provided by an embodiment of the present application.
  • the authentication server can be applied to the system shown in FIG. 1 or FIG. 2 , and can implement the steps performed by the authentication server in the above method embodiments.
  • the authentication server includes:
  • the determining module 031 is configured to determine a target user identifier of the second network device, where the target user identifier indicates the hierarchical position of the second network device in the multi-level user group, where the multi-level user group includes multiple levels of user groups.
  • the target user identifier indicates the hierarchical position of the second network device in the multi-level user group, where the multi-level user group includes multiple levels of user groups.
  • the sending module 032 is configured to send the target user identifier and/or at least one hierarchical access control rule to the first network device, the at least one hierarchical access control rule is in one-to-one correspondence with at least one hierarchical user group in the multi-level user group .
  • the target user identifier is used for the first network device to determine at least one hierarchical access control rule, and perform access control on the service packets sent by the second network device based on the at least one hierarchical access control rule.
  • the authentication server may also include:
  • the receiving module 033 is configured to receive the access authentication information of the second network device sent by the first network device.
  • the receiving module 032 reference may be made to the relevant descriptions of step 207 and step 304 in the above method embodiments.
  • the determining module 031 is configured to determine the target user identifier of the second network device based on the access authentication information if it is determined that the access authentication information of the second network device passes the authentication.
  • the sending module 032 may be configured to: if it is determined that the access authentication information in the authentication message of the second network device passes the authentication, send the corresponding relationship between the message identifier of the service message and the target user identifier to the first network device.
  • step 306 For the implementation of the function of the sending module 032, reference may also be made to the relevant description of step 306 in the above method embodiment.
  • the sending module 032 can also be used for:
  • the corresponding relationship between the user ID and the hierarchical access control rules is issued to the first network device, and the corresponding relationship is used for the first network device to determine at least one hierarchical access based on the target user ID. control rules.
  • step 205 For the function implementation of the sending module 032, reference may also be made to the relevant descriptions of step 205, step 301, and step 302 in the above method embodiments.
  • the determination module 031 can also be used for:
  • At least one hierarchical access control rule is determined based on the target user identifier.
  • the embodiment of the present application provides an authentication server. Since the target user identifier of the second network device delivered by the authentication server can indicate the hierarchical position of the second network device in the multi-level user group, the second network device A network device can determine, based on the target user identifier of the second network device, at least one hierarchical access control rule corresponding to at least one hierarchical user group. Thus, based on the determined at least one hierarchical access control rule, the first network device can perform precise access control on the service packets sent by the second network device. During the access control process, since the first network device can determine one or more hierarchical access control rules based on a target user identifier, flexible and efficient access control on service packets is realized.
  • the first network device and the authentication server provided in the embodiment of the present application may also be implemented by an application-specific integrated circuit (ASIC), or a programmable logic device (programmable logic device, PLD).
  • the PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the access control method provided by the above method embodiment may also be implemented by software, and when the access control method provided by the above method embodiment is implemented by software, each module in the first network device and the authentication server may also be a software module.
  • FIG. 17 is a schematic structural diagram of an access control device provided by an embodiment of the present application.
  • the access control device may be the first network device or the authentication server provided in the above embodiments.
  • the access control device may include: a processor 401 , a memory 402 , a network interface 403 and a bus 404 .
  • the bus 404 is used to connect the processor 401 , the memory 402 and the network interface 403 .
  • the communication connection with other devices can be realized through the network interface 403 (which may be wired or wireless).
  • a computer program 4021 is stored in the memory 402, and the computer program 4021 is used to realize various application functions.
  • the processor 401 may be a CPU, and the processor 401 may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays ( FPGA), GPU or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGA field programmable gate arrays
  • GPU GPU or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general purpose processor may be a microprocessor or any conventional processor or the like.
  • Memory 402 can be volatile memory or nonvolatile memory, or can include both volatile and nonvolatile memory.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • Double data rate synchronous dynamic random access memory double data date SDRAM, DDR SDRAM
  • enhanced SDRAM enhanced synchronous dynamic random access memory
  • SLDRAM synchronous connection dynamic random access memory
  • direct rambus RAM direct rambus RAM
  • bus 404 may also include a power bus, a control bus, a status signal bus, and the like. However, for clarity of illustration, the various buses are labeled as bus 404 in the figure.
  • the processor 401 may be configured to execute the computer program 4021 to implement the steps performed by the first network device in the foregoing method embodiments. If the access control device is an authentication server, the processor 401 may be configured to execute a computer program 4021 to implement the steps performed by the authentication server in the foregoing method embodiments.
  • Fig. 18 is a schematic structural diagram of a first network device provided by an embodiment of the present application.
  • the first network device can be applied to a system such as the system shown in Fig. 1 or Fig. 2, and can implement the method described in the above embodiment Steps performed by a first network device.
  • the first network device may include: a main control board 501 and at least one interface board (the interface board is also called a line card or a service board), for example, an interface board 502 and an interface board 503 are shown in FIG. 18 .
  • a switching fabric board 504 may be included, and the switching fabric board 504 is used to complete data exchange between the interface boards.
  • the main control board 501 is also called a main processing unit (main processing unit, MPU) or a route processing card (route processor card), and the main control board 501 is used to complete functions such as system management, equipment maintenance, and protocol processing.
  • main processing unit main processing unit
  • route processing card route processor card
  • the main control board 501 includes: a central processing unit 5011 and a memory 5012 .
  • Interface boards 502 and 503 are also called line interface unit cards (line processing unit, LPU), line card (line card) or service boards, and the interface boards are used to provide various service interfaces (for example, POS interface, GE interface, ATM interface) etc.), and realize the forwarding of the message.
  • the main control board 501, the interface board 502, and the interface board 503 are connected to the system backplane through a system bus to realize intercommunication.
  • the interface board 502 includes one or more CPUs 5021 .
  • the central processing unit 5021 is used for controlling and managing the interface board 502, communicating with the central processing unit 5011 on the main control board 501, and forwarding and processing messages.
  • the forwarding entry storage 5024 on the interface board 502 is used to store forwarding entries, and the network processor 5022 can forward packets by looking up the forwarding entries stored in the forwarding entry storage 5024 .
  • the interface board 502 includes one or more physical interface cards 5023 for receiving the message sent by the previous hop node, and sending the processed message to the next hop node according to the instructions of the central processing unit 5021 .
  • the specific implementation process will not be described one by one here.
  • the specific functions of the central processing unit 5021 are also not repeated here one by one.
  • the first network device in this embodiment includes multiple interface boards and adopts a distributed forwarding mechanism.
  • the structure of the interface board 503 is basically the same as that of the interface board 502, and the interface board 503
  • the operations on the interface board 502 are basically similar to those of the interface board 502, and will not be repeated for brevity.
  • the central processor 5021 and/or network processor 5022 in the interface board 502 in FIG. For the so-called forwarding plane, special hardware or chip processing is adopted.
  • the central processing unit 5021 and/or the network processor 5022 may also use a general-purpose processor, such as a general-purpose CPU, to implement the functions described above.
  • main control boards 501 there may be one or more main control boards 501, and when there are multiple main control boards, it may include an active main control board and a standby main control board.
  • interface boards There may be one or more interface boards. The stronger the data processing capability of the device, the more interface boards it provides.
  • the multiple interface boards can communicate through one or more switching fabric boards, and when there are multiple interface boards, they can jointly implement load sharing and redundant backup.
  • the device does not need a switching network board, and the interface board undertakes the processing function of the service data of the entire system.
  • the device includes multiple interface boards, which can realize data exchange between multiple interface boards through the switching network board, and provide large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices with a distributed architecture are greater than those with a centralized architecture. Which architecture to use depends on the specific networking deployment scenario, and there is no limitation here.
  • the memory 5012 and the memory 5024 can be read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) Or other types of dynamic storage devices that can store information and instructions can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD- ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic discs or other magnetic storage devices, or can be used to carry or store desired program code and any other medium that can be accessed by a computer, but not limited thereto.
  • ROM read-only memory
  • RAM random access memory
  • EEPROM electrically erasable programmable read-only memory
  • CD- ROM compact disc read-only memory
  • optical disc storage including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the memory 5024 in the interface board 502 may exist independently and be connected to the central processing unit 5021 through a communication bus; or, the memory 5024 may also be integrated with the central processing unit 5021 .
  • the memory 5012 in the main control board 501 can exist independently and be connected to the central processing unit 5011 through a communication bus; or, the memory 5012 can also be integrated with the central processing unit 5011 .
  • the memory 5024 is used to store program codes, which are executed under the control of the CPU 5021
  • the memory 5012 is used to store program codes, which are executed under the control of the CPU 5011 .
  • the central processing unit 5021 and/or the central processing unit 5011 may implement the access control method applied to the first network device provided in the foregoing embodiments by executing program codes.
  • the processor 5011 in the main control board 501 can be used to determine at least one hierarchical access control rule based on the target user ID
  • the memory 5012 can be used to store data, such as storing a reference mask chain and user ID.
  • the interface board 502 and the interface board 503 can be used for exchanging data with the authentication server and the controller, for example, transmitting reference mask chains, user identifiers, layer identifiers, and third correspondences.
  • the program code stored in the memory 5024 and/or the memory 5012 may include one or more software modules.
  • the one or more software modules may be the functional modules provided in the embodiment shown in FIG. 14 or FIG. 15 above.
  • the physical interface card 5023 may use any device such as a transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (radio access network, RAN), wireless local area network (wireless local area networks, WLAN), etc.
  • a transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (radio access network, RAN), wireless local area network (wireless local area networks, WLAN), etc.
  • the embodiment of the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer executes the method provided by the above-mentioned method embodiment.
  • An access control method performed by the first network device or the authentication server.
  • the embodiment of the present application also provides a computer program product containing instructions.
  • the computer program product When the computer program product is run on a computer, the computer is made to execute the access control method performed by the first network device or the authentication server provided by the above method embodiment.
  • the embodiment of the present application also provides an access control system.
  • the system includes: a first network device 01 and at least one second network device 02 .
  • the first network device 01 may be the first network device shown in Fig. 14, Fig. 15, Fig. 17 or Fig. 18, and the first network device 01 may implement steps to execute.
  • the system may further include: an authentication server 03 , and the structure of the authentication server 03 may refer to FIG. 16 or FIG. 17 .
  • the authentication server 03 can implement the steps performed by the authentication server in the above method embodiments.
  • the above-mentioned embodiments may be implemented in whole or in part by software, hardware, firmware or other arbitrary combinations.
  • the above-described embodiments may be implemented in whole or in part in the form of computer program products.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center that includes one or more sets of available media.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media.
  • the semiconductor medium may be a solid state drive (SSD).
  • first and second are used to distinguish the same or similar items with basically the same function and function. It should be understood that “first”, “second” and “nth” There are no logical or timing dependencies, nor are there restrictions on quantity or order of execution. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.

Abstract

本申请提供了一种访问控制方法、设备及系统，属于通信技术领域。本申请提供的方案中，由于第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。

Description

访问控制方法、设备及系统
本申请要求于2021年12月20日提交的申请号为202111566942.2、发明名称为“标签表示方法、装置和系统”的中国专利申请的优先权，以及要求于2022年2月23日提交的申请号为202210167699.5、发明名称为“访问控制方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，特别涉及一种访问控制方法、设备及系统。
背景技术
访问控制列表(access control lists，ACL)是一种应用在路由器等网络设备上的指令列表，该指令列表也可以称为访问控制规则或接入控制规则。网络设备可以基于该指令列表对接收到的业务报文进行过滤，从而有效地控制用户设备对网络的访问，保障网络安全。
相关技术中，网络管理员可以为每个待管控的用户设备配置至少一个ACL，并为每个ACL分配标识。网络设备可以基于标识指示的ACL对用户设备发送的业务报文进行访问控制。但是，上述访问控制方法的灵活性较低。
发明内容
本申请提供了一种访问控制方法、设备及系统，可以解决相关技术中的访问控制方法的灵活性较低的技术问题。
一方面，提供了一种访问控制方法，应用于第一网络设备，该方法包括：确定第二网络设备的目标用户标识，该目标用户标识指示第二网络设备在多级用户组中的层级位置，该多级用户组包括多个层级的用户组；基于该目标用户标识确定至少一个层级访问控制规则，该至少一个层级访问控制规则与多级用户组中的至少一个层级的用户组一一对应；基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。
由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
可选地，第一网络设备基于该目标用户标识确定至少一个层级访问控制规则的过程可以包括：基于该目标用户标识，确定至少一个层级的目标用户组，该至少一个层级的目标用户组包括第一层级用户组；基于该第一层级用户组，确定对应的第一层级访问控制规则，该至少一个层级访问控制规则包括该第一层级访问控制规则；相应的，基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制的过程可以包括：基于该第一层级访问控制规则，对第二网络设备发送的业务报文进行第一访问控制。
其中，该至少一个层级的目标用户组可以是第二网络设备所属的某一层级的用户组，或者可以包括第二网络设备所属的各个层级的用户组。也即是，第一网络设备可以基于第二网络设备所属的部分或全部层级的用户组所对应的层级访问控制规则，对第二网络设备发送的业务报文进行第一访问控制。
可选地，该至少一个层级的目标用户组还可以包括第二层级用户组，该第二层级用户组为第一层级用户组的上级用户组；第一网络设备基于该目标用户标识确定至少一个层级访问 控制规则的过程还可以包括：基于该第二层级用户组，确定对应的第二层级访问控制规则，该至少一个层级访问控制规则包括该第二层级访问控制规则；相应的，基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制的过程还可以包括：基于该第二层级访问控制规则，对第二网络设备发送的业务报文进行第二访问控制；其中，该第二访问控制在第一访问控制之前或之后执行。
若第二访问控制在第一访问控制之前执行，则表明第一网络设备能够按照层级由高到低的顺序，依次基于各个层级的用户组对应的层级访问控制规则对第二网络设备发送的业务报文进行访问控制。若第二访问控制在第一访问控制之后执行，则表明第一网络设备能够按照层级由低到高的顺序，依次基于各个层级的用户组对应的层级访问控制规则对第二网络设备发送的业务报文进行访问控制。第一网络设备按照用户组的层级顺序，依次执行各个层级的用户组对应的层级访问控制规则，可以实现对第二网络设备发送的业务报文的有序控制。
可选地，基于该目标用户标识确定至少一个层级访问控制规则的过程可以包括：基于该目标用户标识，确定至少一个层级的目标用户组，该至少一个层级的目标用户组包括第一层级用户组和第二层级用户组，该第二层级用户组为第一层级用户组的上级用户组；基于该至少一个层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制的过程可以包括：若未获取到第一层级用户组对应的层级访问控制规则，则基于第二层级用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。
本申请提供的方案中，第二网络设备所属的某一层级的用户组可能未配置对应的层级访问控制规则，此时第一网络设备可以基于上一层级的用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。由此，实现了对第二网络设备发送的业务报文的灵活控制，且有效确保了网络安全。
可选地，第一网络设备基于目标用户标识确定至少一个层级访问控制规则的过程可以包括：基于目标用户标识和目标掩码链确定标识链，该标识链包括至少一个子标识，该标识链指示第二网络设备在多级用户组中的层级位置，且该至少一个子标识与至少一个层级的用户组一一对应；基于该至少一个子标识，确定至少一个层级访问控制规则；其中，该目标掩码链包括与至少一个子标识一一对应的至少一个掩码，每个掩码用于指示对应的一个子标识的长度。
其中，该第一网络设备所获取到的目标用户标识可以是编码态的用户标识，该编码态的用户标识可以由多个X进制数组成，X可以为2、8或16等。由于目标掩码链能够指示目标用户标识中各个子标识的长度，因此第一网络设备可以基于该目标掩码链准确地识别目标用户标识所包括的各个子标识。
可选地，该标识链可以包括多个子标识；基于该至少一个子标识，确定至少一个层级访问控制规则的过程可以包括：确定多个子标识所组成的多个子标识链，其中每个子标识链包括一个子标识或多个连续的子标识，不同子标识链包括的子标识的个数不同，且每个子标识链指示一个层级的用户组；确定每个子标识链指示的一个层级的用户组所对应的一个层级访问控制规则。
由于目标用户标识包括多个子标识能够组成不同的子标识链，不同的子标识链能够指示不同层级的用户组，因此第一网络设备基于目标掩码链识别出目标用户标识包括的各个子标识后，即可确定出该第二网络设备所属的多个不同层级的用户组。
可选地，在基于目标用户标识确定至少一个层级访问控制规则之前，该方法还可以包括： 接收认证服务器下发的该目标掩码链；或者，接收该认证服务器下发的该目标用户标识的层级标识，并基于该层级标识从基准掩码链中确定该目标掩码链；其中，该层级标识用于指示标识链所包括的子标识的个数，该基准掩码链包括多个掩码，且该基准掩码链包括的掩码的个数大于或等于该标识链包括的子标识的个数。
其中，认证服务器是用于对第二网络设备进行接入认证的服务器。该基准掩码链可以是第一网络设备中预先配置的，例如可以是由认证服务器或控制器预先下发至第一网络设备的。由于第一网络设备中预先配置有基准掩码链，因此认证服务器在下发目标用户标识时，无需再携带该目标用户标识的目标掩码链，而仅需携带该目标用户标识的层级标识即可。由此，有效减少了认证服务器和第一网络设备之间所需交互的数据的数据量。
可选地，第一网络设备确定第二网络设备的目标用户标识的过程可以包括：向认证服务器上报该第二网络设备的接入认证信息；接收该认证服务器下发的第二网络设备的目标用户标识，该目标用户标识是认证服务器在确定该接入认证信息认证通过后下发的。
认证服务器在确定第二网络设备的接入认证信息认证通过后，再下发该第二网络设备的目标用户标识，可以确保第二网络设备接入网络时的安全性和可靠性。
可选地，在接收该认证服务器下发的第二网络设备的目标用户标识之后，该方法还可以包括：记录报文标识与该目标用户标识的第一对应关系，该报文标识由第二网络设备发送的报文所携带；基于该第一对应关系，以及基于该目标用户标识确定出的至少一个层级访问控制规则，记录该报文标识与该至少一个层级访问控制规则的第二对应关系；相应的，基于该至少一个层级访问控制规则对第二网络设备发送的业务报文进行访问控制的过程可以包括：在接收到第二网络设备发送的业务报文后，从该第二对应关系中确定该业务报文的报文标识所对应的至少一个层级访问控制规则；基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。
由于第一网络设备可以记录第二对应关系，因此后续再接收到第二网络设备发送的业务报文时，即可直接基于业务报文的报文标识，从该第二对应关系中获取对应的至少一个层级访问控制规则，并基于获取到的至少一个层级访问控制规则对业务报文进行访问控制。由此，有效提高了对业务报文进行访问控制的效率。
可选地，第一网络设备确定第二网络设备的目标用户标识的过程可以包括：接收认证服务器下发的报文标识与目标用户标识的第一对应关系；在接收到第二网络设备发送的业务报文后，基于该业务报文的报文标识，从该第一对应关系中确定第二网络设备的目标用户标识。
其中，该第一网络设备可以是访问控制系统中的汇聚层设备或核心层设备。访问控制系统中的接入层设备可以向认证服务器上报携带有第二网络设备的接入认证信息的认证报文，认证服务器在确定第二网络设备的接入认证信息认证通过后，可以向第一网络设备下发该认证报文的报文标识与目标用户标识的第一对应关系。
可选地，基于该目标用户标识确定至少一个层级访问控制规则的过程可以包括：基于用户标识与层级访问控制规则的第三对应关系，确定该目标用户标识对应的至少一个层级访问控制规则。
第一网络设备中可以预先存储有用户标识与层级访问控制规则的第三对应关系，第一网络设备可以基于该第三对应关系，快速地确定出目标用户标识所对应的至少一个层级访问控制规则。
可选地，在基于该目标用户标识确定至少一个层级访问控制规则之前，该方法还可以包 括：接收第三网络设备下发的该用户标识与层级访问控制规则的第三对应关系。其中，该第三网络设备可以是认证服务器或控制器。
可选地，该目标用户标识包括：一级子标识和二级子标识；其中，该一级子标识用于指示至少一个层级的用户组中的一级用户组，该一级子标识和二级子标识的组合用于指示该至少一个层级的用户组中的二级用户组，且该一级用户组为二级用户组的上一层级的用户组。
由于目标用户标识中包括的两个子标识可以指示两个不同层级的用户组，因此第一网络设备基于该一个目标用户标识，即可确定出两个不同层级的用户组的层级访问控制规则。
可选地，该目标用户标识还包括：三级子标识；该一级子标识、二级子标识和三级子标识的组合用于指示该至少一个层级的用户组中的三级用户组，且该二级用户组为三级用户组的上一层级的用户组。
可以理解的是，该目标用户标识还可以包括更多级别的子标识，例如四级子标识和五级子标识等。
可选地，该第一网络设备可以属于一级用户组，该第二网络设备可以属于二级用户组；相应的，第一网络设备基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制的过程可以包括：基于该一级用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。
本申请提供的方案中，访问控制系统可以包括多个不同层级的第一网络设备，每个层级的第一网络设备可以基于多级用户组中部分层级范围的层级访问控制规则对第二网络设备发送的业务报文进行访问控制。例如，第一网络设备可以基于其所属层级的用户组的层级访问控制规则对业务报文进行访问控制。由此，实现了对第二网络设备的分级或分区管控，可以满足各类差异化的安全管控要求，有效提高了管控的灵活性。
另一方面，提供了一种访问控制方法，应用于认证服务器，该方法包括：确定第二网络设备的目标用户标识，该目标用户标识指示第二网络设备在多级用户组中的层级位置，该多级用户组包括多个层级的用户组；将该目标用户标识和/或至少一个层级访问控制规则下发至第一网络设备；其中，该目标用户标识用于供第一网络设备确定该至少一个层级访问控制规则，并基于该至少一个层级访问控制规则对第二网络设备发送的业务报文进行访问控制。
可选地，认证服务器确定第二网络设备的目标用户标识的过程可以包括：接收该第一网络设备发送的第二网络设备的接入认证信息；若确定该第二网络设备的接入认证信息认证通过，则基于该接入认证信息确定第二网络设备的目标用户标识。
可选地，将目标用户标识下发至第一网络设备的过程可以包括：若确定第二网络设备的认证报文中的接入认证信息认证通过，则将该认证报文的报文标识与该目标用户标识的对应关系下发至第一网络设备。
可选地，在将该目标用户标识下发至第一网络设备之前，该方法还可以包括：向第一网络设备下发用户标识与层级访问控制规则的对应关系，该对应关系用于供第一网络设备基于该目标用户标识确定该至少一个层级访问控制规则。
可选地，在将该至少一个层级访问控制规则下发至第一网络设备之前，该方法还可以包括：基于该目标用户标识确定该至少一个层级访问控制规则。
又一方面，提供了一种第一网络设备，该第一网络设备包括至少一个模块，该至少一个模块可以用于实现上述方面所提供的应用于第一网络设备的访问控制方法。
再一方面，提供了一种认证服务器，该认证服务器包括至少一个模块，该至少一个模块 可以用于实现上述方面所提供的应用于认证服务器的访问控制方法。
再一方面，提供了一种第一网络设备，该第一网络设备包括：存储器，处理器及存储在该存储器上并可在该处理器上运行的计算机程序，该处理器执行该计算机程序时实现如上述方面所提供的应用于第一网络设备的访问控制方法。
再一方面，提供了一种认证服务器，该认证服务器包括：存储器，处理器及存储在该存储器上并可在该处理器上运行的计算机程序，该处理器执行该计算机程序时实现如上述方面所提供的应用于认证服务器的访问控制方法。
再一方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当该指令在计算机上运行时，使得计算机执行如上述任一方面所提供的访问控制方法。
再一方面，提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行如上述任一方面所提供的访问控制方法。
再一方面，提供了一种访问控制系统，该系统可以包括如上述方面提供的第一网络设备以及至少一个第二网络设备。
可选地，该系统还可以包括如上述方面提供的认证服务器。
综上所述，本申请提供了一种访问控制方法、设备及系统。本申请提供的方案中，由于第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该第二网络设备的目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
附图说明
图1是本申请实施例提供的一种访问控制系统的结构示意图；
图2是本申请实施例提供的另一种访问控制系统的结构示意图；
图3是本申请实施例提供的一种多级用户组的示意图；
图4是本申请实施例提供的另一种多级用户组的示意图；
图5是本申请实施例提供的一种访问控制方法的流程图；
图6是本申请实施例提供的一种多级用户组中各用户组的子标识的示意图；
图7是本申请实施例提供的另一种多级用户组中各用户组的子标识的示意图；
图8是本申请实施例提供的另一种访问控制方法的流程图；
图9是本申请实施例提供的一种对业务报文进行访问控制的流程图；
图10是本申请实施例提供的另一种对业务报文进行访问控制的流程图；
图11是本申请实施例提供的又一种对业务报文进行访问控制的流程图；
图12是本申请实施例提供的再一种对业务报文进行访问控制的流程图；
图13是本申请实施例提供的又一种访问控制方法的流程图；
图14是本申请实施例提供的一种第一网络设备的结构示意图；
图15是本申请实施例提供的另一种第一网络设备的结构示意图；
图16是本申请实施例提供的一种认证服务器的结构示意图；
图17是本申请实施例提供的一种访问控制设备的结构示意图；
图18是本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
下面结合附图详细介绍本申请实施例提供的访问控制方法、设备及系统。
图1是本申请实施例提供的一种访问控制系统的结构示意图，如图1所示，该访问控制系统可以包括：第一网络设备01、多个第二网络设备02，以及认证服务器03。其中，第一网络设备01用于将至少一个第二网络设备02接入网络，认证服务器03用于在第二网络设备02接入网络之前，对该至少一个第二网络设备02进行认证。
该第一网络设备01可以为路由器或交换机等具有报文转发功能的设备。该第二网络设备02可以是路由器或交换机等具有报文转发功能的设备，也可以是终端设备。其中，该终端设备也可以称为用户设备，其可以是手机、笔记本电脑或者台式电脑等计算机设备。该认证服务器03可以是一台独立的物理服务器，也可以是多台物理服务器组成的服务器集群，或者可以是云服务器(也称云计算服务中心)。
在本申请实施例中，可以采用多级用户组的方式对多个第二网络设备02进行管理。该多级用户组包括多个不同层级的用户组，每一层级的用户组可以包括一个或多个用户组。其中，除最高层级的用户组之外，每个用户组均归属于上一层级的某个用户组，且不同的用户组可以归属于上一层级的同一个用户组或不同的用户组。或者，可以理解为：层级较高的某个用户组可以划分为层级较低的多个用户组。每个第二网络设备02可以属于多级用户组中的末级用户组，该末级用户组是指没有进一步划分下一层级的用户组的用户组。或者，每个第二网络设备02可以属于多级用户组中某一层级，或者可以理解为第二网络设备02所属层级的用户组能够划分为多个末级用户组。
可以理解的是，若某个第二网络设备02所属的某一层级的用户组还归属于上一层级的某个用户组，则该第二网络设备02也属于该上一层级的用户组。
作为一种可能的示例，如图2所示，该访问控制系统还可以包括控制器04。网络管理员可以在控制器04上将该多个第二网络设备02划分成多个不同层级的用户组。例如，参考图3，网络管理员可以基于多个第二网络设备02所属企业或机构的组织结构，将该多个第二网络设备02划分成四级用户组。
其中，一级用户组包括研发部和市场部共两个用户组，研发部可以划分为设计部和开发部，市场部可以划分为国内组和海外组。相应的，二级用户组可以包括：设计部，开发部，国内组和海外组。二级用户组中的设计部可以划分为硬件设计组和软件设计组，开发部可以划分为硬件开发组和软件开发组，国内组可以划分为1组，2组和3组，海外组未进行下一层级的用户组的划分。相应的，三级用户组可以包括：硬件设计组，软件设计组，硬件开发组，软件开发组，1组，2组和3组。该三级用户组中的软件开发组进一步划分为软件开发一组和软件开发二组，三级用户组中的其他用户组未进行下一层级的用户组的划分。相应的，四级用户组可以包括：软件开发一组和软件开发二组。基于上述分析可知，在图3所示的示例中，硬件设计组、软件设计组、软件开发一组、软件开发二组、1组、2组、3组以及海外组均属于末级用户组。
继续参考图3，员工张三和李四的第二网络设备02(例如用户设备)属于三级用户组中的硬件设计组，则还属于二级用户组中的设计部，以及一级用户组中的研发部。员工王五和赵六的第二网络设备02属于四级用户组中的软件开发二组，则还属于三级用户组中的软件开发 组，二级用户组中的开发部，以及一级用户组中的研发部。员工钱七的第二网络设备02属于三级用户组中的3组，则还属于二级用户组中的国内组，以及一级用户组中的市场部。员工孙八的第二网络设备02属于二级用户组中的海外组，则还属于一级用户组中的市场部。
作为另一种可能的示例，该访问控制系统中还可以包括目录服务器，例如动态目录(active directory，AD)服务器。该目录服务器中预先存储有企业或机构的组织结构。该目录服务器或控制器04可以基于该组织结构，自动生成多级用户组。示例的，目录服务器自动生成的多级用户组可以如图4所示。
基于上述分析可知，每个第二网络设备02可以属于多个不同层级的用户组，而为了实现对不同层级的用户组的精确管控，可以分别为每个层级的用户组配置访问控制规则。例如，网络管理人员可以在认证服务器上为每个层级的用户组配置至少一个ACL，并为每个ACL分配一个编号。但是，传统的ACL的编号属于单级的标识体系，在对多级用户组进行复杂管控时的应用灵活性较低。
本申请实施例提供了一种访问控制方法，该访问控制方法可以实现对多级用户组中的网络设备的灵活管控。本申请实施例提供的方法可以应用于第一网络设备，该第一网络设备可以用于转发第二网络设备发送的业务报文，并可以对第二网络设备发送的业务报文进行访问控制。例如，该第一网络设备可以是图1或图2所示系统中的第一网络设备01。如图5所示，该访问控制方法包括：
步骤101、确定第二网络设备的目标用户标识，该目标用户标识指示第二网络设备在多级用户组中的层级位置。
对于接入至网络的第二网络设备，第一网络设备可以确定该第二网络设备的目标用户标识。作为一种可能的示例，第一网络设备可以将第二网络设备的接入认证信息(如用户名和密码)发送至认证服务器，认证服务器在确定该接入认证信息认证通过后，可以向第一网络设备下发该第二网络设备的目标用户标识。相应的，第一网络设备可以接收认证服务器下发的该第二网络设备的目标用户标识。作为另一种可能的示例，第二网络设备发送的报文中可以携带有其自身的目标用户标识，相应的，第一网络设备可以从第二网络设备发送的报文中获取该第二网络设备的目标用户标识。
在本申请实施例中，由于第二网络设备的目标用户标识能够指示第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该目标用户标识确定第二网络设备所属的某一层级的用户组(例如末级用户组)，以及该层级用户组所归属的各个上级用户组。也即是，第一网络设备能够基于该目标用户标识，确定第二网络设备所属的一个或多个不同层级的用户组。
步骤102、基于该目标用户标识确定至少一个层级访问控制规则。
在本申请实施例中，网络管理人员可以为多级用户组中的至少一个层级的用户组配置访问控制规则。例如，可以为多级用户组中的每一层级的用户组均配置访问控制规则。第一网络设备可以基于第二网络设备在多级用户组中的层级位置，确定出用于对第二网络设备发送的业务报文进行访问控制的访问控制规则。该访问控制规则可以包括至少一个层级访问控制规则，该至少一个层级访问控制规则是指一个层级访问控制规则或者多个层级访问控制规则。并且，该至少一个层级访问控制规则与多级用户组中的至少一个层级的用户组一一对应。该至少一个层级的用户组可以是第二网络设备所属的各个层级的用户组中的部分或全部。其中， 该层级访问控制规则也可以称为接入控制规则、报文转发规则或报文过滤规则等，其能够指示第二网络设备访问网络的权限。例如，该层级访问控制规则可以指示第二网络设备所能够访问的网络地址，和/或，禁止访问的网络地址。
步骤103、基于该至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。
第一网络设备在接收到第二网络设备发送的报文后，可以基于确定出的至少一个层级访问控制规则，对该业务报文进行访问控制。其中，基于层级访问控制规则对业务报文进行访问控制可以是指：基于层级访问控制规则转发或丢弃业务报文；或者可以理解为：基于层级访问控制规则过滤业务报文。
综上所述，本申请实施例提供了一种访问控制方法，由于第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该第二网络设备的目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
下文对第二网络设备的用户标识的表示形式进行说明。在本申请实施例中，第二网络设备的用户标识可以具有两种形态：用户态和编码态。其中，用户态用于在用户界面中呈现，以便网络管理人员进行配置，提升用户体验；编码态用于设备之间的交互，例如用于认证服务器和第一网络设备之间的交互。
其中，网络管理人员所配置的用户态的用户标识也可以称为标识链，其包括按照层级关系依次排列的多个子标识(也可以称为标识，或标识符等)，相邻两个子标识由分隔符隔开。其中，该分隔符可以是“.”，也可以是“，”“:”或者“\”等，本申请实施例对该分隔符的实现形式不做限定，只要确保能够区分不同的子标识即可。假设分隔符为“.”，且用户标识包括N个子标识(N为大于1的整数)，则该用户态的用户标识(标识链)可以表示为：
一级子标识.二级子标识.….N-1级子标识.N级子标识；
其中，每个子标识可以表示多级用户组中一个层级的用户组，且该N个子标识可以按照所表示的N个层级的用户组的层级关系依次排列。例如，若该标识链采用大端模式表示，则按照由左到右的顺序，该标识链中各个子标识表示的用户组的层级依次降低。也即是，用于表示最高层级的用户组的子标识位于最左端(即最前端)，用于表示最低层级的用户组的子标识位于最右端(即最后端)。相应的，该一级子标识表示的一级用户组可以是二级子标识表示的二级用户组的上一层级的用户组，二级子标识表示的二级用户组是三级子标识表示的三级用户组的上一层级的用户组。
可以理解的是，用户标识中的N个子标识也可以按照小端模式表示，本申请实施例对此不做限定。并且，若某个用户标识包括N个子标识，则该用户标识可以称为N级用户标识或N级标识链。
还可以理解的是，标识链中的每个子标识可以是其所表示的用户组的名称，例如研发部或市场部等。或者，该每个子标识也可以是其所表示的用户组的编号或编码，该用户组的编号或编码可以由数值(例如二进制数或十进制数)表示，当然也可以由字母等其他类型的字 符表示。并且，若位于同一层级的两个用户组归属于同一个上一层级的用户组，则该两个用户组的编号(或编码)不同。
示例的，对于图3所示的多级用户组，参考图6，每个用户组的编码可以为十进制数。例如，一级用户组中的研发部的编码为0，市场部的编码为1；二级用户组中的设计部的编码为0，开发部的编码为1，国内组的编码为0，海外组的编码为1。
基于图6可知，员工张三的第二网络设备所属的用户组可以包括：三级用户组中的硬件设计部，二级用户组中的设计部，以及一级用户组中的研发部。相应的，张三的第二网络设备的用户标识(即3级标识链)可以表示为：研发部.设计部.硬件设计组，或者0.0.0。
基于该3级标识链，还可以进一步确定出张三的第二网络设备的2级标识链：研发部.设计部，或者0.0。并且，还可以确定出张三的第二网络设备的1级标识链:研发部，或者0。
同理，员工王五和赵六的第二网络设备所属的用户组可以包括：四级用户组中的软件开发二组，三级用户组中的软件开发组，二级用户组中的开发部，以及一级用户组中的研发部。相应的，王五和赵六的第二网络设备的用户标识(即4级标识链)可以表示为：研发部.开发部.软件开发组.软件开发二组，或者0.1.1.1。并且，其3级标识链可以表示为：研发部.开发部.软件开发组，或者0.1.1。2级标识链可以表示为：研发部.开发部，或者0.1。1级标识链可以表示为：研发部，或者0。
员工钱七的第二网络设备所属的用户组的3级标识链可以表示为：市场部.国内组.3组，或者1.0.2。员工孙八的第二网络设备所属的用户组的2级标识链可以表示为：市场部.海外组，或者1.1。
基于上述分析可知，不同层级的标识链(即不同长度的标识链)可以指示不同层级的用户组。或者可以理解为：不同数量的子标识的组合可以指示不同层级的用户组。又或者还可以理解为：N级标识链中的N个子标识能够组成N个不同的子标识链，该N个子标识链所包括的子标识的个数依次为1至N，其中每个子标识链能够指示一个层级的用户组。
由于通常情况下，设备中能够用于表示用户标识的计算机资源有限，即用户标识所占用的字符数(如二进制位数)是固定的或有限的。例如，通常一个用户标识可以采用一个字节、两个字节或两个以上的字节来表示。并且，为了节省资源，设备之间交互时所采用的编码态的用户标识(即编码态的标识链)中是不包括分隔符的。例如，参考表1，每个编码态的标识链可以采用两个字节(即16位)的二进制数表示。
表1
Figure PCTCN2022139553-appb-000001
可以理解的是，对于一个采用二进制数表示的编码态的标识链，若为每个层级的子标识划分不同的位数，则该编码态的标识链转换成用户态后，可以有多种不同的表示。例如，参考表2，对于采用16位二进制数表示的编码态的标识链：1101 0000 0000 0101，若采用示例1的划分方式：为一级子标识划分4位二进制数，为二级子标识划分5位二进制数，并为三级子标识划分7位二进制数，则对应的用户态的标识链为：13.0.5。若采用示例2的划分方式：为一级子标识、二级子标识和三级子标识分别划分3位二进制数，并为四级子标识划分5位二进制数，则对应的用户态的标识链为：6.4.0.5。
表2
Figure PCTCN2022139553-appb-000002
基于上述分析可知，对于同一个编码态的标识链，若为每个层级的子标识划分的位数不同，则该编码态的标识链可以转换成多种不同的用户态的标识链。在本申请实施例中，为了便于设备从编码态的标识链中识别各个子标识，可以采用掩码链来指示标识链中各个子标识的长度。其中，N级标识链的掩码链可以包括N个掩码，该N个掩码与N级标识链中的N个子标识一一对应，每个掩码用于指示对应的一个子标识的长度。其中，子标识的长度是指子标识的编码空间的长度，即编码态的子标识所占用的存储空间的大小。该存储空间的大小可以用字节数或二进制位数来表征。
示例的，参考表3，掩码链中的一级掩码可以用于指示标识链中一级子标识的长度(即编码态的一级子标识占用的二进制位数)，二级掩码可以用于指示标识链中二级子标识的长度；以此类推，N级掩码可以用于指示标识链中N级子标识的长度。
表3
Figure PCTCN2022139553-appb-000003
基于表3可知，对于编码态的标识链的二进制位数为固定位数的场景，将不同长度的二进制位分给不同层级的子标识，并采用掩码来指示每一层级的子标识所占用的二进制位数，就能明确区分和识别出编码态的标识链中的各个子标识。由此，可以实现采用固定长度的编码态的标识链(例如16bit的标识链)来灵活表示不同层级的用户标识。
可选地，每个第二网络设备的用户态的标识链和掩码链可以表示为：标识链/掩码链。其中，“/”表示标识链与掩码链之间的分隔符，该分隔符也可以采用其他符号表示，本申请实施例对此不做限定。若某个掩码链包括N个掩码，则该掩码链也可以称为N级掩码链。
N级标识链的N级掩码链的用户态的表示形式可以为:
/一级掩码:二级掩码:…:N-1级掩码:N级掩码；
其中，一级掩码表示N级标识链中一级子标识的长度，N级掩码标识N级子标识的长度。“:”为掩码之间的分隔符，该分隔符的形式不限，除了“:”之外，还可以是“.”“,”或者“\”等。并且，在本申请实施例中，为方便说明与识别，当单独采用数值表示掩码时，在其前面带上“/”作为前缀以示该数值为掩码。
如前所述，掩码是指子标识的编码空间的长度，该长度可以是基于子标识所属层级中所需区分的子标识的个数，即对应层级的用户组中所需区分的用户组的个数(或种类数)确定的。并且，某一层级中所需区分的子标识的个数越多(即对应层级中所需区分的用户组的个数越多)，则该层级的子标识的长度就需要设置的越长，该层级的子标识所对应的掩码的数值就越大。例如，若某一层级的用户组中最多有M个用户组归属于上一层级的同一个用户组，则该层级的用户组中所需区分的用户组的个数即为M，M为大于1的整数。
示例的，参考图7，由于一级用户组只包括研发部和市场部2个用户组，因此可以采用长度为1的子标识(即1bit二进制数)进行表示。其中，研发部的编码可以为0，市场部的编码可以为1。也即是，用于指示研发部的子标识为0，用于指示市场部的子标识为1。二级用户组中，由于设计部和开发部归属于研发部，国内组和海外组归属于市场部，因此二级用户组也可以采用长度为1的子标识进行表示。三级用户组中，由于1组、二组和3组共3个用户组归属于国内组，因此该三级用户组至少需要长度为2的子标识进行表示。例如，1组可以编码为00，二组可以编码为01，3组可以编码为10。
在本申请实施例中，一个N级用户标识及其掩码链的完整表示形式可以如下：
一级子标识.二级子标识.….N级子标识/一级掩码:二级掩码:…:N级掩码
可以理解的是，由于标识链的长度(例如二进制位数)是固定的，因此，用户态的掩码链中的某一级掩码可以省略。例如掩码链中的一级掩码或最末级掩码(即N级掩码)可以省略。并且，该省略的掩码可以通过其他掩码计算获得。示例的，假设省略的掩码为一级掩码，则一个N级用户标识及其掩码链的表示形式可以如下：
一级子标识.二级子标识.….N级子标识/二级掩码:…:N级掩码
其中，掩码链中省略的一级掩码的数值可以采用如下公式计算得到：
一级掩码＝编码态的标识链的固定长度(如16)-(二级掩码+三级掩码+…N-1级掩码+N级掩码)。
为方便说明和理解，下文以完整的掩码链表示形式(即掩码链包含所有的掩码)为例进行说明。假设二进制数表示的编码态的标识链为：1101 0000 0000 0101，且该标识链的掩码链为3级掩码链/2:4:10。参考表4，基于该3级掩码链/2:4:10中的一级掩码/2，可以确定标识链中的一级子标识的长度为2bit，进而可以基于编码态的标识链中的前2个bit“00”，确定出用户态的一级子标识为3。同理，基于掩码链中的二级掩码/4，可以确定标识链中的二级子标识的长度为4bit，进而可以基于编码态的标识链中的第3至6个bit“0100”，确定出用户态的二级子标识为4。基于掩码链中的三级掩码/10，可以确定标识链中的三级子标识的长度为10bit，进而可以基于编码态的标识链中的最后10个bit“00 0000 0101”，确定出用户态的三级子标识为5。也即是，用户态的标识链为3.4.5。
表4
Figure PCTCN2022139553-appb-000004
基于表4可知，由于一级子标识的长度为2bit，因此一共可以分配4个不同的一级子标识(如 0-3)，也即是，一级用户组中最多可以存在4个用户组。由于二级子标识的长度为4bit，因此一共可以分配16个不同的二级子标识(如0-15)，也即是，二级用户组中最多可以存在16(即2 4)个用户组归属于同一个一级用户组。由于三级子标识的长度为10bit，因此一共可以分配1024(即2 10)个不同的三级子标识(如0-1023)，也即是，三级用户组中最多可以存在1024个用户组归属于同一个二级用户组。
对于表4所示的编码态的标识链：1101 0000 0000 0101，若该标识链的掩码链为4级掩码链/2:2:8:4。则参考表5，基于该4级掩码链/2:2:8:4，可以确定出对应的用户态的标识链为2.3.255.15。基于表5可知，由于一级子标识和二级子标识的长度均为2bit，因此一共可以分配4个不同的一级子标识，且可以分配4个不同的二级子标识。由于三级子标识的长度为8bit，因此一共可以分配256个不同的三级子标识。由于四级子标识的长度为4bit，因此一共可以分配16个不同的四级子标识。
表5
Figure PCTCN2022139553-appb-000005
基于上述分析，可以确定出图6所示的各个员工的第二网络设备的用户标识及掩码链如下：
对于员工张三，其第二网络设备的3级用户标识和掩码链为：0.0.0/1:1:1。
2级用户标识和掩码链为：0.0/1:1。
1级用户标识和掩码链为：0/1。
对于员工王五，其第二网络设备的4级用户标识和掩码链为：0.1.1.1/1:1:1:1。
3级用户标识和掩码链为：0.1.1/1:1:1。
2级用户标识和掩码链为：0.1/1:1。
1级用户标识和掩码链为：0/1，与张三的1级用户标识相同，表示王五和张三属于同一个一级用户组。
对于员工钱七，其第二网络设备的3级用户标识和掩码链为：1.0.2/1:1:2，其余类推。
对于员工孙八，其第二网络设备的2级用户标识和掩码链为：1.1/1:1，其余类推。
表6
Figure PCTCN2022139553-appb-000006
可以理解的是，上述实施例均是以采用二进制数表示编码态的标识链为例进行说明的。 为了便于设备之间传输或交换编码态的标识链，还可以将该二进制数等效为十进制数(下文简称为等效标识)。当然，除了十进制数之外，也可以等效为其他进制数，例如十六进制数，本申请实施例对此不做限定。例如，假设某个3级标识链及其掩码链为3.4.5/2:4:10，则参考表6可以看出，该3级标识链3.4.5的等效标识为53253。
同理，若某个4级标识链及其掩码链为2.3.255.15/2:2:8:4，则参考下述表7可以看出，该4级标识链2.3.255.15的等效标识为49151。
表7
Figure PCTCN2022139553-appb-000007
可以理解的是，若掩码链中每一级掩码的长度(例如二进制位数)是固定的，则用户态的掩码链也可以转换为编码态。该编码态的掩码链中不包括分隔符，且可以采用二进制数表示。并且，该二进制数表示的编码态的掩码链还可以等效为十进制数(下文简称为等效掩码)。当然，除了十进制数之外，也可以等效为其他进制数，例如十六进制数，本申请实施例对此不做限定。基于此，可以避免采用分隔符，从而进一步降低对资源或字节数的要求。
作为一种可能的示例，若标识链中各级子标识的长度相等，则可以采用平均分配位数的方法来表示编码态的各级掩码，即编码态的各级掩码的长度可以相等。例如，假设编码态的掩码链的总长度为16bit，则对于一个4级标识链，掩码链中需要设置4个掩码，其中每个编码态的掩码的长度可以为4bit。同理，对于一个8级标识链，掩码链中需设置8个掩码，则每个编码态的掩码的长度可以为2bit。
示例的，参考表8，假设某个4级标识链及其掩码链为：2.3.15.15/4:4:4:4，若编码态的掩码链的长度为16bit，则采用平均分配二进制方法时，该4级掩码链/4:4:4:4中的每个掩码的长度可以为4bit，即每个掩码可以由4bit的二进制数表示。相应的，该4级掩码链的编码态可以表示为：0100 0100 0100 0100，其等效掩码为/17476。
表8
Figure PCTCN2022139553-appb-000008
可选地，若掩码链中的各级掩码均相等，即标识链中各级子标识的长度均相等，则还可以采用类似/::X的方式简化表示用户态的掩码链。其中，/::表示后续跟着的数值为掩码，::表示各级掩码均相等，X表示掩码(即各级子标识的长度)。可以理解的是，也可以采用其他标 识符代替“::”，本申请实施例对此不做限定。
例如，1.1.1.1/::4可以表示一个4级标识链，且该4级标识链中各级子标识对应的掩码均为4，即各级子标识的长度均为4bit。
作为一种可能的示例，若标识链中各级子标识的长度不相等，则掩码链中各级掩码的长度也可以不同。若各级掩码的长度不同，但均为固定长度，则也可以采用等效掩码来表示。该示例可以应用于预先约定好各级掩码的长度的通信系统。
示例的，参考表9，假设某个6级标识链及其掩码链为：1.2.2.3.3.3/2:2:2:2:4:4，预先约定的编码态的掩码链的长度为16bit，且该6级掩码链中一级至四级掩码的长度均为2bit，五级和六级掩码的长度均为4bit。相应的，该6级掩码链的编码态可以表示为：1010 1010 0100 0100，其等效掩码为/43588。
表9
Figure PCTCN2022139553-appb-000009
在本申请实施例中，设备之间传递编码态的标识链时，可以同步传递掩码链，以确保设备(例如第一网络设备)能够基于掩码链识别编码态的标识链中的各级子标识，进而确定第二网络设备在多级用户组中的层级位置。但是，若在传递每个编码态的标识链时均同步传递掩码链，则会增加设备之间交互时所需传递的数据的数据量，无法起到节省设备资源的作用。
为了进一步节省设备资源，本申请实施例提供的方案还可以为多级用户组配置基准掩码链，该基准掩码链也可以称为统一定长掩码，或者，统一最长掩码。其中，“统一”是指同一个层级的子标识均采用同样的掩码，即同一层级的各个子标识的编码长度是一致的。例如图7中，三级用户组中的各个用户组均统一采用2bit二进制数进行编码，而不是一部分采用1bit二进制数编码，另一部分采用2bit二进制数编码。
“最长”或“定长”是指将多级用户组的所有层级均表示出来，即该统一最长掩码的层级可以等于多级用户组的标识链的最长层级。例如图7中，该多级用户组的层级最多为4级，因此，该统一最长掩码的层级数为4，即该统一最长掩码为4级掩码链。
可以理解的是，采用统一最长掩码的方案后，访问控制系统中的各个设备中可以预先配置有该统一最长掩码。相应的，设备之间在交互编码态的标识链时，无需再携带该标识链的掩码链，而仅需携带该标识链的层级标识即可，由此有效减少了设备之间所需交互的数据的数据量。该层级标识可以用于指示标识链的层级数，即标识链中包括的子标识的个数。用户态的标识链和层级标识可以表示为：标识链/标识级别。例如，对于一个N级标识链，其用户态的标识链和层级标识可以表示为：
一级子标识.二级子标识.….N级子标识/N
其中，标识级别“/N”表示该标识链为N级标识链，即该标识链包括N个子标识。
示例的，图7所示的多级用户组中，由于除了三级用户组外，其他各个层级的用户组(下文简称为各级用户组)均可以采用一位二进制数来编码，因此，其他各级用户组的子标识所对应的掩码可以均为1。但是，对于三级用户组，虽然设计部和开发部下属的各个用户组均可以采用一位二进制数进行编码，但由于国内组下属的三级用户组需要用两位二进制数进行编码，因此，按统一最长掩码的配置原则，该三级用户组统一采用两位二进制数进行编码。也即是，该三级用户组的子标识所对应的掩码可以为2。相应的，图7所示的多级用户组的统一最长掩码可以为/1:1:2:1，即采用长度为5的标识链(即5bit的二进制数)即可表示图7所示的多级用户组。
图7所示的多级用户组中各个用户组的标识链、层级标识以及对应的掩码链可以参考表10。表10中以标识链的长度为5bit为例进行说明。并且，表10中二进制编码中的x可以表示预设的无效二进制数，即设备可以忽略该位二进制数。其中，x可以为0或1，本申请实施例以x＝0为例进行说明。
表10
Figure PCTCN2022139553-appb-000010
参考表10可以看出，最小层级的用户组为四级用户组：软件开发一组和软件开发二组。该四级用户组对应的掩码链即为统一最长掩码/1:1:2:1，相应地，其他各级用户组的标识链、层级标识和对应的掩码链可以为：
1、张三的第二网络设备所属的各级用户组：
张三的第二网络设备所属的三级用户组(即硬件设计组)，其用户态的标识链和层级标识为0.0.0/3，其中/3表示该标识链为3级标识链，其等效标识及层级标识可以表示为0/3。设备基于该层级标识/3，可以从统一最长掩码/1:1:2:1中提取前3级掩码，从而得到该3级标识链实际对应的掩码链/1:1:2。
张三的第二网络设备所属的二级用户组(即设计部)，其用户态的标识链和层级标识为0.0/2，其中/2表示该标识链为2级标识链，其等效标识及层级标识可以表示为0/2。设备基于该层级标识/2，可以从统一最长掩码/1:1:2:1中提取前2级掩码，从而得到该2级标识链实际对应的掩码链/1:1。
张三的第二网络设备所属的一级用户组(研发部)，其用户态的标识链和层级标识为0/1，其中/1表示该标识链为1级标识链，其等效标识及层级标识可以表示为0/1。设备基于该层级标识/1，可以从统一最长掩码/1:1:2:1中提取第1级掩码，从而得到该1级标识链实际对应的掩码链/1。
2、王五的第二网络设备所属的各级用户组：
王五的第二网络设备所属的四级用户组(即软件开发二组)，其用户态的标识链和层级标识为0.1.1.1/4，其等效标识及层级标识可以表示为11/4。设备从统一最长掩码/1:1:2:1中提取前4级掩码后可以得到该标识链实际对应的掩码链/1:1:2:1。
王五的第二网络设备所属的三级用户组(即软件开发组)，其用户态的标识链和层级标识为0.1.1/3，其等效标识及层级标识可以表示为10/4。设备从统一最长掩码/1:1:2:1中提取前3级掩码后可以得到该标识链实际对应的掩码链/1:1:2。
王五的第二网络设备所属的二级用户组(即开发部)，其用户态的标识链和层级标识为0.1/2，其等效标识及层级标识可以表示为8/2。设备从统一最长掩码/1:1:2:1中提取前2级掩码后可以得到该标识链实际对应的掩码链/1:1。
王五的第二网络设备所属的一级用户组(即研发部)，其用户态的标识链和层级标识为0/1，其等效标识及层级标识可以表示为0/1，与张三的一级用户组的标识相同，说明属于同一个一级用户组。设备从统一最长掩码/1:1:2:1中提取前1级掩码后可以得到该标识链实际对应的掩码链/1。
3、钱七的第二网络设备所属的各级用户组：
钱七的第二网络设备所属的三级用户组(即3组)，其用户态的标识链和层级标识为1.0.2/3，其等效标识及层级标识可以表示为20/3。设备从统一最长掩码/1:1:2:1中提取前3级掩码后可以得到该标识链实际对应的掩码链/1:1:2。
钱七的第二网络设备所属的二级用户组(即国内组)，其用户态的标识链和层级标识为1.0/2，其等效标识及层级标识可以表示为16/2。设备从统一最长掩码/1:1:2:1中提取前2级掩码后可以得到该标识链实际对应的掩码链/1:1。
钱七的第二网络设备所属的一组用户组(即市场部)，其用户态的标识链和层级标识为16/1，其等效标识及层级标识可以表示为1/1。设备从统一最长掩码/1:1:2:1中提取前1级掩码后可以得到该标识链实际对应的掩码链/1。
4、孙八的第二网络设备所属的各级用户组：
孙八的第二网络设备所属的二级用户组(即海外组)，其用户态的标识链和层级标识为1.1/2，其等效标识及层级标识可以表示为24/2。设备从统一最长掩码/1:1:2:1中提取前2级掩码后可以得到该标识链实际对应的掩码链为/1:1；
孙八的第二网络设备所属的一组用户组(即市场部)，其用户态的标识链和层级标识为16/1，其等效标识及层级标识可以表示为1/1，与钱七的一级用户组的标识相同，说明属于同一个一级用户组。设备从统一最长掩码/1:1:2:1中提取前1级掩码后可以得到该标识链实际对应的掩码链/1。
基于上述示例可知，对于同一个编码态的标识链，由于其层级标识不同，即实际对应的掩码链不同，则可以表示出不同长度或层级的标识。例如，对于张三的第二网络设备所属的用户组，可以通过标识链和层级标识(如0/1、0/2、0/3)表示出不同层级的用户组。并且，再结合固定编码长度的统一最长掩码，就可以基于层级标识在固定长度的编码态的编码链中动态划分出不同层级的子标识。
如前文所述，用户态的标识链中能够采用分隔符区分不同的子标识，例如，张三的第二网络设备所属的三级用户组采用分隔符来表示的标识链为0.0.0。由于采用了分隔符，因此可以明确识别各级子标识及其层级。同理，用户态的掩码链中也能够采用分隔符区分不同的掩码，例如，掩码链/2:2:4也明确表明了各级掩码及其层级。基于此，可以根据使用场景的不同，采用不同的用户态的标识链和用户态的掩码链的组合形式，例如，可以只采用用户态的标识链，而无需携带用户态的掩码链。比如，用户态的标识链0.0.0可以直接表示一个3级标识链。或者，也可以采用标识链和掩码链的完整表示方式，如0.0.0/1:2:3。
对于编码态的标识链，由于其未采用分隔符，因此需依赖掩码链(或者，统一最长掩码和层级标识)才区分出所包含的各个层级的子标识。
对于图7所示的多级用户组中的每一层级的用户组，其用户态的标识链、掩码链和层级标识，以及编码态的标识链和层级标识可以参考表11。其中，对于编码态，表11中以二进制编码为例进行示意，并且表11中还示出了二进制数所等效成的十进制数。例如，三级用户组中的3组的用户态的标识链和层级标识为1.0.2/3，编码态的标识链和层级标识为10100/00011，等效为十进制数后则可以表示为20/3。
表11
Figure PCTCN2022139553-appb-000011
上文均是以二进制数表示编码态的用户标识和掩码链为例进行的说明。可以理解的是， 还可以采用其他编码方式表示编码态的用户标识和掩码链，例如还可以采用十进制数或十六进制数表示，本申请实施例对此不做限定。
图8是本申请实施例提供的另一种访问控制方法的流程图，该访问控制方法可以应用于图1或图2所示的系统中。如图8所示，该访问控制方法包括：
步骤201、控制器确定各个第二网络设备的用户标识，以及基准掩码链。
其中，每个第二网络设备的用户标识能够指示该第二网络设备在多级用户组中的层级位置，即能够指示出该第二网络设备所属的各个层级的用户组。
作为一种可能的实现方式，网络管理人员可以基于各个第二网络设备在多级用户组中的层级位置，在控制器上为各个第二网络设备配置用户标识。例如，网络管理人员能够将各个第二网络设备划分为多级用户组，该多级用户组包括多个层级的用户组，每个层级的用户组包括一个或多个用户组。并且，网络管理人员能够为该多级用户组中的每个用户组配置一个子标识，相应的，每个第二网络设备的用户标识即为该第二网络设备所属的各个层级的用户组的子标识所组成的标识链。
在该实现方式中，网络管理人员还可以基于多级用户组所包括的层级的数量，以及每一层级的用户组的数量，在控制器中配置基准掩码链。该基准掩码链也可以称为统一最长掩码或者统一定长掩码。此外，可以理解的是，网络管理人员在控制器上配置的用户标识和基准掩码链的形态均可以为用户态。
作为另一种可能的实现方式，控制器也可以基于预先存储的各个第二网络设备的组织结构，以及预先存储的标识配置规则，自动为各个第二网络设备配置用户标识。并且，控制器可以基于多级用户组所包括的层级的数量，以及每一层级的用户组的数量，自动生成基准掩码链。
示例的，参考图6，假设网络管理人员将多个第二网络设备划分为了四级用户组，其中员工钱七的第二网络设备属于三级用户组中的3组，则从图6可以看出，员工钱七的第二网络设备的用户标识为1.0.2。并且，基准掩码链可以为/1:1:2:1。
步骤202、控制器将各个第二网络设备的用户标识发送至认证服务器。
控制器获取到各个第二网络设备的用户标识后，即可将该用户标识均发送至认证服务器。在本申请实施例中，控制器可以将每个第二网络设备的用户标识由用户态转换成编码态，然后再将用户态和编码态的用户标识均发送至认证服务器。其中，用户态的用户标识用于供网络管理人员在认证服务器上配置访问控制规则，编码态的用户标识用于供认证服务器与第一网络设备进行交互。
可以理解的是，控制器在向认证服务器下发编码态的用户标识时，还需同步下发该用户标识的掩码链或者层级标识。例如，控制器可以下发编码态的掩码链或编码态的层级标识；或者，控制器可以下发编码态和用户态的编码链，或下发编码态和用户态的层级标识。
示例的，参考表11，对于用户态的用户标识1.0.2，控制器可以将其转换为编码态10100，或者20。并且，控制器向认证服务器下发的编码态的用户标识和层级标识可以为10100/00011，或者可以为20/3。
步骤203、控制器将基准掩码链下发至第一网络设备。
在本申请实施例中，控制器还可以将编码态的基准掩码链下发至第一网络设备。例如，控制器可以将网络管理人员配置的用户态的基准掩码链转换成编码态，然后再下发至第一网 络设备。示例的，对于用户态的基准掩码链/1:1:2:1，控制器可以将其转换为/0001 0001 00100001，或者/4385，并下发至第一网络设备。
步骤204、认证服务器基于为各个层级的用户组配置的层级访问控制规则，生成用户标识与层级访问控制规则的第三对应关系。
在本申请实施例中，控制器将用户态和编码态的用户标识下发至认证服务器之后，网络管理人员还可以在认证服务器上基于该用户态的用户标识，为至少一个层级的用户组配置层级访问控制规则。例如，网络管理人员可以为每个层级的每个用户组均配置一个层级访问控制规则，且为任一层级的用户组配置的一个层级访问控制规则可以包括多个子规则。认证服务器获取到网络管理人员配置的层级访问控制规则后，即可生成用户标识与层级访问控制规则的第三对应关系。其中，该第三对应关系中记录的用户标识可以是编码态的用户标识，或者可以既包括编码态的用户标识，也包括用户态的用户标识。
示例的，认证服务器生成的第三对应关系可以如表12所示。参考表12，网络管理人员为一级用户组中的研发部(即用户标识0)配置的层级访问控制规则为R1，为二级用户组中的国内组(即用户标识1.0)配置的层级访问控制规则包括R4和R5两个子规则。并且，对于二级用户组中的开发部(即用户标识0.1)，以及三级用户组中的硬件开发组(即用户标识0.1.1)，网络管理人员未配置层级访问控制规则。
表12
Figure PCTCN2022139553-appb-000012
步骤205、认证服务器将第三对应关系下发至第一网络设备。
认证服务器生成第三对应关系后，即可将该第三对应关系下发至第一网络设备。例如，认证服务器可以将表12所示的第三对应关系下发至第一网络设备。
可以理解的是，上述步骤204和步骤205也可以由控制器执行。也即是，控制器可以生成 第三对应关系并将该第三对应关系下发至第一网络设备。换言之，假设将访问控制系统中用于生成并下发第三对应关系的设备称为第三网络设备，则该第三网络设备可以是认证服务器，也可以是控制器。
步骤206、第二网络设备向第一网络设备发送认证报文。
在本申请实施例中，每个第二网络设备在接入网络时，均可以先向第一网络设备发送认证报文，该认证报文中携带有第二网络设备的接入认证信息。其中，该接入认证信息可以包括第二网络设备的用户名和密码。
步骤207、第一网络设备向认证服务器上报接入认证信息。
第一网络设备在接收到任一第二网络设备发送的认证报文后，可以将该认证报文中的接入认证信息上报至认证服务器，以供认证服务器进行认证。
步骤208、认证服务器若确定第二网络设备认证通过，则基于该接入认证信息确定第二网络设备的目标用户标识。
认证服务器接收到第一网络设备上报的接入认证信息后，可以对该接入认证信息进行认证。认证服务器若确定该接入认证信息认证通过(即第二网络设备认证通过)，则可以基于预先存储的接入认证信息与用户标识的对应关系，确定该第二网络设备的目标用户标识。其中，接入认证信息与用户标识的对应关系中可以记录有第二网络设备的用户名及对应的用户标识。
例如，认证服务器可以获取接入认证信息中的用户名，并获取预先存储的与该用户名对应的密码。之后，认证服务器可以检测接入认证信息中的密码是否与其预先存储的密码相同，若两者相同，则认证服务器可以确定第二网络设备认证通过，并获取第二网络设备的目标用户标识。若认证服务器确定第二网络设备认证未通过，则可以向第一网络设备反馈认证失败的第一提示信息。第一网络设备进而可以将该第一提示信息转发至第二网络设备，以便第二网络设备重新上报接入认证信息。
在本申请实施例中，认证服务器在确定第二网络设备的目标用户标识的同时，还可以确定该目标用户标识的层级标识，或者该目标用户标识的目标掩码链。
步骤209、认证服务器向第一网络设备下发第二网络设备的目标用户标识。
认证服务器获取到第二网络设备的目标用户标识后，即可向第一网络设备下发该目标用户标识。可选地，认证服务器可以向第一网络设备下发该第二网络设备的目标用户标识和层级标识，或者下发该第二网络设备的目标用户标识和目标掩码链。
示例的，假设第一网络设备向认证服务器上报了员工钱七的第二网络设备的接入认证信息，认证服务器在确定该接入认证信息认证通过后，可以获取员工钱七的第二网络设备的目标用户标识和层级标识：20/3，或者10100/00011，并下发至第一网络设备。
可以理解的是，在上述步骤209中，认证服务器还可以向第一网络设备下发认证通过的第二提示信息，第一网络设备可以将该第二提示信息转发至第二网络设备，第二网络设备进而可以向第一网络设备发送业务报文以访问网络。
步骤210、第一网络设备记录报文标识与该目标用户标识的第一对应关系。
在上述步骤206中，第二网络设备发送的认证报文中携带有报文标识。第一网络设备在接收到认证服务器下发的目标用户标识后，可以记录该认证报文的报文标识与该目标用户标识的第一对应关系。可选地，该第一对应关系中还可以记录有目标用户标识的层级标识或者目标掩码链。
可以理解的是，该报文标识可以是报文的五元组信息中的部分或全部信息，或者还可以是七元组信息中的部分或全部信息。
步骤211、第一网络设备基于第三对应关系，确定该目标用户标识对应的至少一个层级访问控制规则。
在本申请实施例中，第一网络设备接收到认证服务器下发的目标用户标识后，可以获取该目标用户标识的目标掩码链。该目标掩码链包括与该目标用户标识中包括的至少一个子标识一一对应的至少一个掩码，每个掩码用于指示对应的一个子标识的长度。然后，第一网络设备可以基于该目标掩码链中的至少一个掩码，确定出该目标用户标识包括的至少一个子标识。或者可以理解为：第一网络设备能够基于该目标用户标识和目标掩码链确定标识链(即用户态的标识链)，该标识链包括至少一个子标识，且该标识链能够指示第二网络设备在所述多级用户组中的层级位置。并且，该至少一个子标识与第二网络设备所属的至少一个层级的用户组一一对应，其中每个子标识可以为其所对应的一个层级的用户组的编码。
之后，第一网络设备可以基于该至少一个子标识，确定出用于对第二网络设备发送的业务报文进行访问控制的访问控制规则。该访问控制规则包括至少一个层级访问控制规则，即一个层级访问控制规则或者多个层级访问控制规则。
可选地，该目标用户标识可以包括多个子标识。第一网络设备在基于该多个子标识确定至少一个层级访问控制规则时，可以先确定该多个子标识所能够组成的多个子标识链。其中，每个子标识链包括一个子标识或多个连续的子标识，不同子标识链包括的子标识的个数不同，且每个子标识链能够指示一个层级的用户组。或者可以理解为：该多个子标识能够组成多个不同级别的用户标识。又或者，还可以理解为：第一网络设备基于目标用户标识和目标掩码链所确定出的某一层级的标识链可以包含多个不同层级的标识链。
然后，第一网络设备即可基于预先存储的第三对应关系，确定多个子标识组成的每个子标识链(即多个子标识组成的每个用户标识)对应的一个层级访问控制规则，从而可以得到多个层级访问控制规则。
可选地，第一网络设备可以按照预设顺序对标识链中不同数量的子标识依次进行组合，从而得到多个不同长度的子标识链。其中，该预设顺序可以是从左到右的顺序，也可以是从右到左的顺序。例如，假设目标用户标识包括N个子标识(N为大于1的整数)，则第一网络设备可以从n＝N开始，按照预设顺序对前n个子标识进行组合得到一个子标识链。之后，可以将n更新为n-1，即n＝n-1，并继续按照该预设顺序对前n个子标识进行组合得到一个子标识链。以此类推，直至n＝0。基于此，第一网络设备共可以确定出N个不同长度的子标识链。
作为一种可选的实现方式，该目标用户标识的目标掩码链可以是由认证服务器直接下发至第一网络设备的。也即是，第一网络设备可以接收认证服务器下发的目标掩码链，并基于该目标掩码链和目标用户标识确定标识链，即基于该目标掩码链确定目标用户标识包括的各个子标识。
作为另一种可选的实现方式，认证服务器可以向第一网络设备下发目标用户标识的层级标识。相应的，第一网络设备接收到认证服务器下发的层级标识后，可以先基于该层级标识从预先存储的基准掩码链中确定目标掩码链。之后，即可基于该目标掩码链和目标用户标识确定标识链。
其中，该层级标识用于指示标识链所包括的子标识的个数，该基准掩码链包括多个掩码，且该基准掩码链包括的掩码的个数大于或等于标识链包括的子标识的个数。第一网络设备可 以从基准掩码链中按照预设顺序提取前目标数量个掩码，从而得到该目标掩码链。该目标数量即为层级标识所指示的目标用户标识包括的子标识的个数。其中，该预设顺序可以是从左到右的顺序，也可以是从右到左的顺序。
示例的，假设基准掩码链为1:1:2:1，第一网络设备接收到的目标用户标识为10100，层级标识为00011，则第一网络设备基于该层级标识00011可以确定该目标用户标识为3级用户标识。进而，第一网络设备可以从基准掩码链1:1:2:1中提取前3个掩码(即前3级掩码)，得到目标掩码链1:1:2。
参考表13，该目标掩码链中的一级掩码/1指示目标用户标识中的一级子标识的长度为1，因此第一网络设备可以确定目标用户标识10100中的第一位“1”即为一级子标识。该目标掩码链中的二级掩码/1指示目标用户标识中的二级子标识的长度为1，因此第一网络设备可以确定目标用户标识10100中的第二位“0”即为二级子标识。该目标掩码链中的三级掩码2指示目标用户标识中的三级子标识的长度为/2，因此第一网络设备可以确定目标用户标识10100中的第三位和第四位“10”即为三级子标识，即三级子标识为2。由于目标掩码链1:1:2可以指示该目标用户标识的有效长度为4，因此第一网络设备可以确定目标用户标识的最后一位“0”为无效位，并可以忽略该最后一位。
表13
Figure PCTCN2022139553-appb-000013
基于上述分析可知，第一网络设备可以确定出该目标用户标识10100所包括的3个子标识依次为1，0和2，也即是，可以确定出用户态的标识链为1.0.2。第一网络设备进而可以确定该3个子标识能够组成3级子标识链1.0.2，也可以组成2级子标识链1.0，且还可以组成1级子标识链1。也即是，该3个子标识可以组成3个不同长度的子标识链，即3个不同层级的用户标识。
进一步的，基于表12所示的第三对应关系，第一网络设备可以确定出3级子标识链1.0.2对应的三级用户组的层级访问控制规则为R12，2级子标识链1.0对应的二级用户组的层级访问控制规则包括R4和R5，1级子标识链1对应的一级用户组的层级访问控制规则为R2。
步骤212、第一网络设备基于第一对应关系，以及该至少一个层级访问控制规则，记录该报文标识与该至少一个层级访问控制规则的第二对应关系。
第一网络设备确定出该目标用户标识指示的至少一个层级访问控制规则之后，即可记录报文标识与至少一个层级访问控制规则的第二对应关系。由此，第一网络设备后续再接收到第二网络设备发送的业务报文后，即可直接基于业务报文的报文标识，从该第二对应关系中获取对应的至少一个层级访问控制规则，并基于获取到的至少一个层级访问控制规则对业务报文进行访问控制。也即是，第一网络设备无需每次接收到第二网络设备发送的业务报文后，都先确定第二网络设备的目标用户标识，并识别该目标用户标识包括的各个子标识。由此，有效提高了对业务报文进行访问控制的效率。
示例的，假设第二网络设备发送的认证报文中的报文标识为源互联网协议(Internet protocol，IP)地址:192.168.x.x，则第一网络设备记录的第二对应关系可以包括：报文标识 192.168.x.x，以及对应的如下层级访问控制规则：三级用户组的层级访问控制规则R12，二级用户组的层级访问控制规则R4和R5，以及一级用户组的层级访问控制规则R2。
可以理解的是，上述步骤209至步骤212是以认证服务器下发第二网络设备的目标用户标识为例进行的说明。可以理解的是，在上述步骤209中，认证服务器还可以下发该目标用户标识和至少一个层级访问控制规则。相应的，第一网络设备在接收到认证服务器下发的信息后，即可直接记录报文标识与该至少一个层级访问控制规则的第二对应关系。
或者，在上述步骤209中，认证服务器也可以仅下发至少一个层级访问控制规则，而无需下发第二网络设备的目标用户标识。相应的，第一网络设备也可以无需执行上述步骤210所示的方法，而是可以基于该认证服务器下发的至少一个层级访问控制规则，直接记录该第二对应关系。
步骤213、第二网络设备向第一网络设备发送业务报文。
在本申请实施例中，第二网络设备在确定其接入认证信息认证通过后，即可向第一网络设备发送业务报文，以访问网络。该业务报文中携带有报文标识，且该报文标识与第二网络设备发送的认证报文中的报文标识相同。
步骤214、第一网络设备从第二对应关系中确定业务报文的报文标识所对应的至少一个层级访问控制规则。
第一网络设备接收到第二网络设备发送的业务报文后，可以获取该业务报文中的报文标识。进而，可以从第二对应关系中确定该报文标识所对应的至少一个层级访问控制规则。例如，假设业务报文的报文标识为192.168.x.x，则第一网络设备可以从第二对应关系中确定与该报文标识对应的层级访问控制规则包括：三级用户组的层级访问控制规则R12，二级用户组的层级访问控制规则R4和R5，以及一级用户组的层级访问控制规则R2。
步骤215、第一网络设备基于该至少一个层级访问控制规则，对业务报文进行访问控制。
在本申请实施例中，第一网络设备可以基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。也即是，可以基于该至少一个层级访问控制规则对业务报文进行转发或丢弃。
可选地，第一网络设备对业务报文进行访问控制后，还可以将访问控制的结果发送至第二网络设备或者其他设备(例如控制器)。其中，访问控制的结果可以包括对该业务报文所应用的访问控制规则。
上述步骤212是以第一网络设备基于目标用户标识确定出第二网络设备所属的每一层级的用户组，进而确定出每一层级的用户组对应的层级访问控制规则为例进行的说明。可以理解的是，若第二网络设备属于多个不同层级的用户组(即目标用户标识的层级数大于1)，则在步骤212中，第一网络设备也可以从该多个不同层级的用户组中确定至少一个层级的目标用户组，并确定该至少一个层级的目标用户组所对应的至少一个层级访问控制规则。
若该至少一个层级的目标用户组包括第一层级用户组，则第一网络设备可以基于该第一层级用户组，确定对应的第一层级访问控制规则。该至少一个层级访问控制规则包括该第一层级访问控制规则。相应的，在上述步骤215中，第一网络设备即可基于该第一层级访问控制规则，对该第二网络设备发送的业务报文进行第一访问控制。
例如，假设目标用户标识的用户态为1.0.2，则第一网络设备可以基于该目标用户标识确定第二网络设备分别属于三级用户组中的3组，二级用户组中的国内组，以及一级用户组中的市场部。若第一网络设备从该三个不同层级的用户组中确定的至少一个层级的目标用户组包 括三级用户组中的3组(即第一层级用户组为3组)，则第一网络设备可以基于表12所示的第三对应关系，确定该3组对应的第一层级访问控制规则为R12。进而，第一网络设备可以基于该层级访问控制规则R12，对第二网络设备发送的业务报文进行第一访问控制。
在本申请实施例中，该至少一个层级的目标用户组可以是第一网络设备基于预先配置的规则确定的。例如，该至少一个层级的目标用户组可以是第二网络设备所属的各个层级的用户组中层级最高或层级最低的至少一个层级的用户组。或者，该至少一个层级的目标用户组可以是第一网络设备中预先配置的指定层级的用户组。
可选地，该至少一个层级的目标用户组还可以包括第二层级用户组，该第二层级用户组为第一层级用户组的上级用户组。该上级用户组可以是层级高于第一层级用户组的任一层级的用户组。例如，若第一层级用户组为三级用户组，则该第二层级用户组可以为二级用户组或一级用户组。
相应的，在步骤212中，第一网络设备还能够基于该第二层级用户组，确定对应的第二层级访问控制规则，该至少一个层级访问控制规则还包括该第二层级访问控制规则。在上述步骤215中，第一网络设备还可以基于该第二层级访问控制规则，对第二网络设备发送的业务报文进行第二访问控制。
其中，该第二访问控制可以在第一访问控制之前或之后执行。也即是，第一网络设备可以按照层级由高到低，或者层级由低到高的顺序，依次执行各个层级的目标用户组所对应的层级访问控制规则。
例如，假设目标用户标识的用户态为1.0.2，且第一网络设备从该目标用户标识指示的三个不同层级的用户组中确定的第二层级用户组为二级用户组中的国内组。则第一网络设备可以基于表12所示的第三对应关系，确定该第二层级用户组对应的第二层级访问控制规则包括R4和R5。进而，第一网络设备可以基于该层级访问控制规则R4和R5对第二网络设备发送的业务报文进行第二访问控制。并且，第一网络设备可以在执行完层级访问控制规则R12之后，再执行层级访问控制规则R4和R5。或者，第一网络设备可以先执行层级访问控制规则R4和R5，然后再执行层级访问控制规则R12。
可选地，对于该至少一个层级的目标用户组包括第一层级用户组和第二层级用户组，且第二层级用户组为第一层级用户组的上级用户组的场景。若第一网络设备在上述步骤212中未获取到该第一层级用户组对应的层级访问控制规则，则在上述步骤215中，第一网络设备可以基于该第二层级用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。
可以理解的是，对于多级用户组中的部分层级的用户组，网络管理人员可能并未为该部分层级的用户组配置对应的层级访问控制规则。相应的，第一网络设备若未获取到第二网络设备所属的第一层级用户组对应的层级访问控制规则，则可以基于该第一层级用户组的上级用户组所对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。由此，实现了对第二网络设备发送的业务报文的灵活控制，且有效确保了网络安全。
示例的，假设第一网络设备确定出的用户态的目标用户标识为0.1.0。若第一网络设备基于该目标用户标识0.1.0所确定的第一层级用户组为二级用户组中的开发部(2级用户标识为0.1)，第二层级用户组为一级用户组中的研发部(1级用户标识0)。则基于表12所示的第三对应关系可知，该第三对应关系中并未记录第一层级用户组对应的层级访问控制规则。由此，第一网络设备可以获取并执行一级用户组中研发部所对应的层级访问控制规则R1。
下文以第一网络设备按照层级由低到高的顺序，依次基于第二网络设备所属的每一层级的用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制为例进行说明。参考图9，该访问控制的实现过程可以包括如下步骤：
S11、基于层级标识确定目标用户标识的层级n。
例如，若层级标识为/00011或者/3，则第一网络设备可以确定目标用户标识的层级n＝3。
S12、确定n级用户标识对应的n级用户组的层级访问控制规则。
由于是按照层级由低到高的顺序进行访问控制，因此第一网络设备可以先确定n级用户标识(即n级标识链)所对应的n级用户组的层级访问控制规则。
示例的，假设目标用户标识的用户态为1.0.2，且n＝3，则第一网络设备可以确定3级用户组的层级访问控制规则为R12。
S13、执行n级用户组的层级访问控制规则。
例如，第一网络设备可以基于三级用户组的层级访问控制规则为R12对第二网络设备发送的业务报文进行访问控制。
S14、n＝n-1。
第一网络设备对业务报文执行完n级用户组的层级访问控制规则后，即可将n更新为n-1，以便继续获取并执行上一层级的用户组的层级访问控制规则。
S15、判断n是否等于0。
第一网络设备将n更新为n-1后，需要先判断更新后的n是否等于0。若n＝0，则第一网络设备可以确定已执行完所有层级的用户组的层级访问控制规则，并可以结束访问控制操作。若n≠0，则第一网络设备可以继续执行步骤S12至步骤S15，以便继续获取并执行上一层级的用户组的层级访问控制规则。
例如，假设n＝2，则第一网络设备可以从目标用户标识1.0.2中确定出2级子标识链，即2级用户标识1.0。之后，第一网络设备可以获取并执行该2级用户标识1.0所指示的二级用户组的层级访问控制规则R4和R5。在执行完层级访问控制规则R4和R5后，第一网络设备可以将n更新为1，并可以从目标用户标识1.0.2中确定出1级子标识链，即1级用户标识1。之后，第一网络设备可以获取并执行该1级用户标识1所指示的一级用户组的层级访问控制规则R2。
下文以第一网络设备按照层级由高到低的顺序，依次基于第二网络设备所属的每一层级的用户组的层级访问控制规则，对第二网络设备发送的业务报文进行访问控制为例进行说明。参考图10，该访问控制的实现过程可以包括如下步骤：
S21、基于层级标识确定目标用户标识的层级n。
例如，若层级标识为/00011，则第一网络设备可以确定目标用户标识的层级n＝3。
S22、基于最高层级，将层级指示m初始化为1。
由于是按照层级由高到低的顺序进行访问控制，因此第一网络设备可以先确定第二网络设备所属的各个层级的用户组的最高层级。假设最高层级为一级用户组，则第一网络设备可以将层级指示m的值初始化为1，即m＝1。
S23、确定m级用户标识对应的m级用户组的层级访问控制规则。
示例的，假设目标用户标识的用户态为1.0.2，且m＝1，则第一网络设备可以从目标用户标识1.0.2中确定出1级用户标识1，进而确定该1级用户标识1所指示的一级用户组的层级访问控制规则为R2。
S24、执行m级用户组的层级访问控制规则。
例如，第一网络设备可以对第二网络设备发送的业务报文执行层级访问控制规则R2。
S25、判断m是否等于n。
第一网络设备对业务报文执行完成m级用户组的层级访问控制规则后，需要先判断m是否等于n。若m＝n，则第一网络设备可以确定已执行完所有层级的用户组的层级访问控制规则，并可以结束访问控制操作。若m≠n，则第一网络设备可以继续执行步骤S26，以便继续获取并执行下一层级的用户组的层级访问控制规则。
S26、m＝m+1。
第一网络设备若确定m≠n，则可以将m更新为m+1，之后，可以继续执行步骤S23至步骤S25，以便继续获取并执行下一层级的用户组的层级访问控制规则。
例如，第一网络设备将m更新为2后，可以继续获取并执行2级用户标识1.0所指示的二级用户组的层级访问控制规则R4和R5。之后，第一网络设备可以将m更新为3，并继续获取并执行3级用户标识1.0.2所指示的三级用户组的层级访问控制规则R12。
下文以第一网络设备按照层级由低到高的顺序，基于至少一个层级的目标用户组的层级访问控制规则，对第二网络设备发送的业务报文进行访问控制为例进行说明。其中，该至少一个层级的目标用户组是指第二网络设备所属的各个层级的用户组中的部分用户组。也即是，第一网络设备可以基于第二网络设备所属的部分层级的用户组的层级访问控制规则，对第二网络设备进行访问控制。
其中，该至少一个层级的目标用户组可以是第一网络设备中预选配置的。例如，可以是网络管理人员在第一网络设备中配置的，或者可以是控制器或认证服务器下发至第一网络设备的。并且，该至少一个层级的目标用户组可以是第二网络设备所属的n级用户组中的任一层级的用户组；或者，该至少一个层级的目标用户组可以包括n级用户组中层级小于等于m的用户组；又或者，该至少一个层级的目标用户组可以包括n级用户组中层级大于等于m的用户组；再或者，该至少一个层级的目标用户组可以包括n级用户组中层级大于等于m1且小于等于m2的用户组；再或者，该至少一个层级的目标用户组可以是第一网络设备按照层级由高到低或由低到高的顺序，从n级用户组的层级访问控制规则中首次获取到访问控制规则的用户组。其中，m，m1和m2均为第一网络设备中预选配置的不大于n的正整数。
示例的，假设该至少一个层级的目标用户组包括n级用户组中层级大于等于m的用户组，即第一网络设备需要从最低层级的用户组的层级访问控制规则开始，依次执行至层级为m的用户组的层级访问控制规则。则参考图11，第一网络设备对第二网络设备发送的业务报文进行访问控制的实现过程可以包括如下步骤：
S31、基于层级标识确定目标用户标识的层级n。
例如，若层级标识为/00011或者/3，则第一网络设备可以确定目标用户标识的层级n＝3。
S32、确定至少一个层级的目标用户组中的最高层级m。
在该示例中，由于是按照层级由低到高的顺序，对业务报文执行层级大于等于m的用户组的层级访问控制规则，因此第一网络设备可以先确定至少一个层级的目标用户组中的最高层级m。也即是，第一网络设备可以先确定所需执行到的层级m。例如，参考图11，该最高层级m可以等于2。
S33、确定n级用户标识对应的n级用户组的层级访问控制规则。
示例的，假设目标用户标识的用户态为1.0.2，且n＝3，则第一网络设备可以确定三级用户组的层级访问控制规则为R12。
S34、执行n级用户组的层级访问控制规则。
第一网络设备可以对第二网络设备发送的业务报文执行访问控制规则R12。
S35、判断n是否等于m。
第一网络设备对业务报文执行完成n级用户组的层级访问控制规则后，需要先判断n是否等于m。若n＝m，则第一网络设备可以确定已执行完所需执行的层级访问控制规则，并可以结束访问控制操作。若n≠m，则第一网络设备可以继续执行步骤S36，以便继续获取并执行上一层级的用户组的层级访问控制规则。
S36、n＝n-1。
第一网络设备若确定n≠m，则可以将n更新为n-1，之后，可以继续执行步骤S33至步骤S35，以便继续获取并执行上一层级的用户组的层级访问控制规则。例如，第一网络设备将n更新为2之后，可以继续获取并执行二级用户组的层级访问控制规则R4和R5。第一网络设备执行完成层级访问控制规则R4和R5后，由于n＝m＝2，因此可以确定已执行完所需执行的层级访问控制规则，并可以结束访问控制操作。
假设该至少一个层级的目标用户组是第一网络设备按照层级由低到高的顺序，从n级用户组的层级访问控制规则中首次获取到对应的层级访问控制规则的用户组。则参考图12，该第一网络设备对第二网络设备发送的业务报文进行访问控制的实现过程可以包括如下步骤：
S41、基于层级标识确定目标用户标识的层级n。
例如，若层级标识为/00011或者/3，则第一网络设备可以确定目标用户标识的层级n＝3。
S42、确定n级用户标识对应的n级用户组的层级访问控制规则。
由于是按照层级由低到高的顺序进行访问控制，因此第一网络设备可以先确定n级用户标识(即n级标识链)对应的n级用户组的层级访问控制规则。
S43、判断访问控制规则是否获取成功。
若n级用户组的层级访问控制规则获取成功，则第一网络设备可以继续执行步骤S44；若n级用户组的层级访问控制规则未获取成功，即第一网络设备中未配置该n级用户组的层级访问控制规则，则第一网络设备可以继续执行步骤S45。
可以理解的是，网络管理人员在配置层级访问控制规则时，可以仅为部分层级的用户组配置层级访问控制规则，例如，可以仅为一级、二级和三级用户组配置层级访问控制规则，而不为四级用户组配置层级访问控制规则。或者，网络管理人员可以仅为某一层级的部分用户组配置层级访问控制规则，例如对于二级用户组，可以仅为其中的设计部、国内组和海外组配置层级访问控制规则，而不为开发部配置层级访问控制规则。基于此，会出现第一网络设备未获取到某一层级的用户组的层级访问控制规则的情况。
示例的，假设目标用户标识的用户态为1.0.2，且n＝3，则第一网络设备可以从获取到3级用户组的层级访问控制规则R12，并执行步骤S44。若目标用户标识的用户态为0.1，且n＝2，则参考表12可知，第一网络设备无法获取到该2级用户组的层级访问控制规则，因此可以执行步骤S45。
S44、执行n级用户组的层级访问控制规则。
第一网络设备获取到n级用户组的层级访问控制规则后，即可基于该层级访问控制规则对第二网络设备发送的业务报文进行访问控制。并且，在步骤S44之后，第一网络设备即可结束访问控制操作。也即是，第一网络设备在获取到任一层级用户组对应的层级访问控制规则并执行该层级访问控制规则后即可结束操作，而无需再遍历并执行其他层级的用户组所对应的 层级访问控制规则。
S45、n＝n-1。
第一网络设备若未获取到n级用户组对应的层级访问控制规则，则可以将n更新为n-1，以便继续获取上一层级的用户组对应的层级访问控制规则。
例如，对于目标用户标识为0.1，且n＝2的场景，由于第一网络设备未获取到2级用户组的层级访问控制规则，因此可以将n更新为1。
S46、判断n是否等于0。
第一网络设备将n更新为n-1后，需要先判断更新后的n是否等于0。若n＝0，则第一网络设备可以确定已遍历完所有层级的用户组的层级访问控制规则，并可以结束访问控制操作。若n≠0，则第一网络设备可以继续执行步骤S42，以便继续获取上一层级的用户组的层级访问控制规则。
示例的，第一网络设备将n更新为1后，可以继续执行S42，并获取用户标识0指示的一级用户组的层级访问控制规则R1。之后，第一网络设备对业务报文执行该层级访问控制规则R1后，即可结束操作。
上文均是以一个第一网络设备对各个第二网络设备发送的业务报文进行访问控制为例进行的说明。可以理解的是，该访问控制系统中也可以包括多个第一网络设备，该多个第一网络设备可以位于访问控制系统中的不同层级。
对于访问控制系统中包括多个第一网络设备的场景，在上述步骤203中，控制器可以将基准掩码链分别下发至每个第一网络设备。示例的，假设如图2所示，该多个第一网络设备包括接入层设备01a和核心层设备01b，则控制器可以将编码态的基准掩码链分别下发至接入层设备01a和核心层设备01b。
在上述步骤205中，认证服务器可以将第三对应关系分别下发至每个第一网络设备，即每个第一网络设备均能接收到该第三对应关系。或者，认证服务器可以基于每个第一网络设备在访问控制系统中的层级位置，向该第一网络设备下发第三对应关系中相应层级的用户组的用户标识及对应的层级访问控制规则，即每个第一网络设备可以接收到部分第三对应关系。
可选地，认证服务器可以基于每个第一网络设备在访问控制系统中的层级位置，将多级用户组划分为若干层级范围。其中每个层级范围包括一个层级或多个连续的层级，每个第一网络设备对应一个层级范围，且不同的第一网络设备所对应的层级范围不同。之后，认证服务器可以向每个第一网络设备下发对应层级范围的用户标识及对应的层级访问控制规则。
作为一种可能的示例，每个第一网络设备可以属于多级用户组。在该示例中，认证服务器可以将第一网络设备所在层级所属的层级范围，确定为该第一网络设备所对应的层级范围。
示例的，假设访问控制系统包括两个第一网络设备，该两个第一网络设备分别属于一级用户组和三级用户组，则认证服务器可以将诸如图6或图7所示的4级用户组划分为两个层级范围。其中，第一个层级范围包括一级用户组，第二个层级范围包括二级用户组、三级用户组和四级用户组。认证服务器可以向一级用户组的第一网络设备下发第一个层级范围的用户标识及对应的层级访问控制规则，即一级用户组的用户标识及一级用户组对应的层级访问控制规则。并且，认证服务器可以向三级用户组的第一网络设备下发第二个层级范围的用户标识及层级访问控制规则，即二级用户组、三级用户组和四级用户组的用户标识及对应的层级访问控制规则。
在该示例中，假设第二网络设备属于二级用户组，则在上述步骤215中，二级用户组的第 一网络设备可以基于二级用户组、三级用户组和四级用户组的层级访问控制规则对第二网络设备发送的业务报文进行访问控制。一级用户组的第一网络设备则可以基于一级用户组的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。
作为另一种可能的示例，认证服务器可以基于每个第一网络设备在接入网络中的层级位置(例如接入层、汇聚层或核心层等)，确定该第一网络设备所对应的层级范围。
例如，参考图2，假设访问控制系统中的第一网络设备包括接入层设备01a和核心层设备01b，则认证服务器可以确定第一个层级范围(例如一级用户组和二级用户组)与核心层设备01b对应，第二个层级范围(例如三级用户组和四级用户组)与接入层设备01a对应。并且，认证服务器可以向核心层设备01b下发第一个层级范围的用户标识及对应的层级访问控制规则，并向接入层设备01a下发第二个层级范围的用户标识及对应的层级访问控制规则。
下文以访问控制系统中的第一网络设备包括核心层设备01b和接入层设备01a为例，对本申请实施例提供的访问控制方法进行介绍。如图13所示，该方法可以包括如下步骤：
步骤301、第三网络设备向核心层设备下发第一个层级范围的用户标识及对应的层级访问控制规则。
其中，该第三网络设备可以是控制器或认证服务器。该第一个层级范围可以包括多级用户组中层级较高的层级，例如可以包括一级用户组和二级用户组。
步骤302、第三网络设备向接入层设备下发第二个层级范围的用户标识及对应的层级访问控制规则。
该第二个层级范围可以包括多级用户组中层级较低的层级，例如可以包括三级用户组和四级用户组。
步骤303、第二网络设备向接入层设备发送认证报文。
该认证报文中携带有接入认证信息。
步骤304、接入层设备向认证服务器上报接入认证信息。
认证服务器接收到该接入认证信息后，可以对该接入认证信息进行认证。
步骤305、接入层设备接收认证服务器发送的第二网络设备的目标用户标识。
认证服务器若确定接入认证信息认证通过，则可以向接入层设备发送第二网络设备的目标用户标识。例如，认证服务器可以发送目标用户标识和层级标识，或者发送目标用户标识和目标掩码链。
步骤306、核心层设备接收认证服务器发送的报文标识与目标用户标识的第一对应关系。
认证服务器在确定接入认证信息认证通过后，还可以记录该认证报文的报文标识与第二网络设备的目标用户标识的第一对应关系，并将该第一对应关系下发至核心层设备。也即是，认证服务器可以将报文标识与目标用户标识绑定。其中，该报文标识可以是认证服务器从认证报文中获取到的。可以理解的是，认证服务器发送至核心层的第一对应关系中还可以记录有该目标用户标识的层级标识，或者目标掩码链。
步骤307、接入层设备确定该目标用户标识对应的至少一个层级访问控制规则。
接入层设备接收到认证服务器下发的目标用户标识后，即可基于该目标用户标识以及目标掩码链，确定该目标用户标识对应的至少一个层级访问控制规则为第二个层级范围的层级访问控制规则。之后，接入层设备可以记录报文标识与该第二个层级范围的层级访问控制规则的对应关系。
步骤308、第二网络设备向接入层设备发送业务报文。
步骤309、接入层设备基于第二个层级范围的层级访问控制规则，对业务报文进行访问控制。
接入层设备接收到第二网络设备发送的业务报文后，即可基于第二个层级范围的层级访问控制规则，对该业务报文进行访问控制。例如，接入层设备可以基于该业务报文的报文标识，确定该第二个层级范围的层级访问控制规则，并基于确定出的第二个层级范围的层级访问控制规则对该业务报文进行访问控制。
步骤310、接入层设备向核心层设备转发业务报文。
步骤311、核心层设备基于业务报文的报文标识确定对应的目标用户标识。
核心层设备接收到接入层设备转发的业务报文后，可以基于该业务报文的报文标识，查询认证服务器下发的第一对应关系，从而得到第二网络设备的目标用户标识。
步骤312、核心层设备基于第一个层级范围的层级访问控制规则，对业务报文进行访问控制。
核心层设备确定出目标用户标识后，可以基于该目标用户标识和目标掩码链，确定第一个层级范围的层级访问控制规则。之后，核心层设备即可基于该第一个层级范围的层级访问控制规则对该业务报文进行访问控制。
可选地，核心层设备在接收到认证服务器下发的报文标识与目标用户标识的第一对应关系后，还可以基于该第一对应关系，以及第三网络设备下发的第一个层级范围的用户标识及对应的层级访问控制规则，生成报文标识与该第一个层级范围的层级访问控制规则的对应关系。相应的，核心层设备在接收到接入层设备转发的业务报文后，可以基于该报文标识与第一个层级范围的层级访问控制规则的对应关系，采用该第一个层级范围的层级访问控制规则对业务报文进行访问控制。
由于第三网络设备可以将不同层级范围的用户标识及对应的层级访问控制规则下发至不同层级的第一网络设备中，因此可以由不同层级的第一网络设备来执行不同层级范围的层级访问控制规则。也即是，本申请实施例提供的方法实现了对第二网络设备的分级或分区管控，可以满足各类差异化的安全管控要求，有效提高了管控的灵活性。
可以理解的是，接入层设备向核心层设备转发的业务报文中还可以携带有该第二网络设备的标识信息，该标识信息可以包括目标用户标识和层级标识，或者包括目标用户标识和目标掩码链。核心层设备接收到业务报文后，可以直接从业务报文中获取该标识信息，并基于该标识信息确定对应的层级访问控制规则。相应的，核心层设备无需执行上述步骤306所示的方法，即认证服务器可以无需向核心层设备下发报文标识和目标用户标识的第一对应关系。
还可以理解的是，本申请实施例提供的访问控制方法的步骤先后顺序可以进行适当调整，步骤也可以根据情况进行相应增减。例如，上述图8所示实施例中的步骤203可以在步骤202之前执行；或者，步骤210可以根据情况删除。又例如，上述图13所示实施例中的步骤302可以在步骤301之前执行，或者，步骤307可以在步骤306之前执行，或者步骤306可以根据情况删除。
综上所述，本申请实施例提供了一种访问控制方法，由于第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该第二网络设备的目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个 目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
并且，对于第二网络设备属于多个层级的用户组的场景，认证服务器在对第二网络设备进行接入认证后，仅需向第一网络设备下发一个目标用户标识，即可实现对多个不同层级的标识链(即用户标识)的传递。相比于认证服务器分次传输各个层级的用户组对应的层级访问控制规则的标识，本申请实施例提供的方法有效减少了认证服务器(或控制器)与第一网络设备之间的交互次数和交互数据量，简化了交互流程，提高了交互效率，进而提高了访问控制的效率。
图14是本申请实施例提供的一种第一网络设备的结构示意图，该第一网络设备可以应用于诸如图1或图2所示的系统，且可以实现上述方法实施例中由第一网络设备执行的步骤。如图14所示，该第一网络设备包括：
确定模块011，用于确定第二网络设备的目标用户标识，该目标用户标识指示第二网络设备在多级用户组中的层级位置，该多级用户组包括多个层级的用户组。该确定模块011的功能实现可以参考上述方法实施例中步骤101的相关描述。
所述确定模块011，还用于基于目标用户标识确定至少一个层级访问控制规则，该至少一个层级访问控制规则与多级用户组中的至少一个层级的用户组一一对应。该确定模块011的功能实现还可以参考上述方法实施例中步骤102的相关描述。
访问控制模块012，用于基于至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。该访问控制模块012的功能实现可以参考上述方法实施例中步骤103的相关描述。
可选地，该确定模块011可以用于：
基于该目标用户标识，确定至少一个层级的目标用户组，该至少一个层级的目标用户组包括第一层级用户组；
基于该第一层级用户组，确定对应的第一层级访问控制规则，该至少一个层级访问控制规则包括该第一层级访问控制规则；
相应的，该访问控制模块012，可以用于基于该第一层级访问控制规则，对第二网络设备发送的业务报文进行第一访问控制。
该访问控制模块012的功能实现还可以参考图8所示方法实施例中步骤215的相关描述。
可选地，该至少一个层级的目标用户组还包括第二层级用户组，该第二层级用户组为该第一层级用户组的上级用户组；该确定模块011还可以用于：
基于该第二层级用户组，确定对应的第二层级访问控制规则，该至少一个层级访问控制规则包括该第二层级访问控制规则。
该访问控制模块012，还可以用于基于该第二层级访问控制规则，对该第二网络设备发送的业务报文进行第二访问控制；其中，该第二访问控制在第一访问控制之前或之后执行。
该确定模块011和访问控制模块012的功能实现还可以参考图9至图12所示实施例中的相关描述。
可选地，该确定模块011可以用于：
基于该目标用户标识，确定至少一个层级的目标用户组，该至少一个层级的目标用户组包括第一层级用户组和第二层级用户组，该第二层级用户组为第一层级用户组的上级用户组；
该访问控制模块012，可以用于：
若未获取到该第一层级用户组对应的层级访问控制规则，则基于该第二层级用户组对应的层级访问控制规则，对该第二网络设备发送的业务报文进行访问控制。
可选地，该确定模块011可以用于：
基于该目标用户标识和目标掩码链确定标识链，该标识链包括至少一个子标识，该标识链指示该第二网络设备在该多级用户组中的层级位置，该至少一个子标识与至少一个层级的用户组一一对应；
基于该至少一个子标识，确定至少一个层级访问控制规则；其中，该目标掩码链包括与至少一个子标识一一对应的至少一个掩码，每个掩码用于指示对应的一个子标识的长度。
可选地，该标识链包括多个子标识；该确定模块011可以用于：
确定该多个子标识所组成的多个子标识链，其中每个子标识链包括一个子标识或多个连续的子标识，不同子标识链包括的子标识的个数不同，且每个子标识链指示一个层级的用户组；确定每个子标识链指示的一个层级的用户组所对应的一个层级访问控制规则。
可选地，如图15所示，该第一网络设备还可以包括：
接收模块013，用于在确定模块011基于目标用户标识确定至少一个层级访问控制规则之前，接收认证服务器下发的目标掩码链；或者，接收认证服务器下发的目标用户标识的层级标识，并基于层级标识从基准掩码链中确定目标掩码链；
其中，层级标识用于指示标识链所包括的子标识的个数，基准掩码链包括多个掩码，且基准掩码链包括的掩码的个数大于或等于标识链包括的子标识的个数。
该接收模块013的功能实现可以参考上述方法实施例中步骤209以及步骤211的相关描述。
可选地，如图15所示，该第一网络设备还可以包括：
发送模块014，用于向认证服务器上报第二网络设备的接入认证信息。该发送模块014的功能实现可以参考上述方法实施例中步骤206和步骤207，以及步骤304的相关描述。
该接收模块013，还用于接收认证服务器下发的第二网络设备的目标用户标识，该目标用户标识是认证服务器在确定接入认证信息认证通过后下发的。
该接收模块013的功能实现还可以参考上述方法实施例中步骤208和步骤209，以及步骤305的相关描述。
可选地，该确定模块011还可以用于：
在接收模块013接收认证服务器下发的第二网络设备的目标用户标识之后，记录报文标识与目标用户标识的第一对应关系，该报文标识由所述第二网络设备发送的报文所携带；
基于该第一对应关系，以及基于目标用户标识确定出的至少一个层级访问控制规则，记录报文标识与至少一个层级访问控制规则的第二对应关系。
该确定模块011的功能实现还可以参考上述方法实施例中步骤210和步骤212的相关描述。
相应的，该访问控制模块012可以用于：
在接收到第二网络设备发送的业务报文后，从第二对应关系中确定业务报文的报文标识所对应的至少一个层级访问控制规则；
基于至少一个层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。
该访问控制模块012的功能实现还可以参考上述方法实施例中步骤214的相关描述。
可选地，该接收模块013，还可以用于接收认证服务器下发的报文标识与目标用户标识的第一对应关系。该接收模块013的功能实现还可以参考上述方法实施例中步骤306的相关描述。
该确定模块011，用于在接收到第二网络设备发送的业务报文后，基于业务报文的报文标识，从第一对应关系中确定第二网络设备的目标用户标识。该确定模块011的功能实现还可以参考上述方法实施例中步骤311的相关描述。
可选地，该确定模块011可以用于：基于用户标识与层级访问控制规则的第三对应关系，确定目标用户标识对应的至少一个层级访问控制规则。
该确定模块011的功能实现还可以参考上述方法实施例中步骤211的相关描述。
可选地，该接收模块013，还用于在确定模块011基于目标用户标识确定至少一个层级访问控制规则之前，接收第三网络设备下发的用户标识与层级访问控制规则的第三对应关系。
该接收模块013的功能实现还可以参考上述方法实施例中步骤205，步骤301和步骤302的相关描述。
可选地，该目标用户标识包括：一级子标识和二级子标识；
其中，一级子标识用于指示至少一个层级的用户组中的一级用户组，该一级子标识和二级子标识的组合用于指示至少一个层级的用户组中的二级用户组，且一级用户组为二级用户组的上一层级的用户组。
可选地，该目标用户标识还包括：三级子标识；
该一级子标识、二级子标识和三级子标识的组合用于指示至少一个层级的用户组中的三级用户组，且二级用户组为三级用户组的上一层级的用户组。
可选地，该第一网络设备属于一级用户组，第二网络设备属于二级用户组；
该访问控制模块012，用于基于一级用户组对应的层级访问控制规则，对第二网络设备发送的业务报文进行访问控制。该访问控制模块012的功能实现还可以参考上述方法实施例中步骤309和步骤312的相关描述。
综上所述，本申请实施例提供了一种第一网络设备，由于第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该第二网络设备的目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
图16是本申请实施例提供的一种认证服务器的结构示意图，该认证服务器可以应用于诸如图1或图2所示的系统，且可以实现上述方法实施例中由认证服务器执行的步骤。如图16所示，该认证服务器包括：
确定模块031，用于确定第二网络设备的目标用户标识，该目标用户标识指示第二网络设备在多级用户组中的层级位置，该多级用户组包括多个层级的用户组。该确定模块031的功能实现可以参考上述方法实施例中步骤208的相关描述。
发送模块032，用于将目标用户标识和/或至少一个层级访问控制规则下发至第一网络设备，该至少一个层级访问控制规则与多级用户组中的至少一个层级的用户组一一对应。
其中，目标用户标识用于供第一网络设备确定至少一个层级访问控制规则，并基于至少一个层级访问控制规则对第二网络设备发送的业务报文进行访问控制。
该发送模块032的功能实现可以参考上述方法实施例中步骤209和步骤305的相关描述。
可选地，如图16所示，该认证服务器还可以包括：
接收模块033，用于接收第一网络设备发送的第二网络设备的接入认证信息。该接收模块032的功能实现可以参考上述方法实施例中步骤207和步骤304的相关描述。
该确定模块031，用于若确定第二网络设备的接入认证信息认证通过，则基于接入认证信息确定第二网络设备的目标用户标识。
可选地，该发送模块032可以用于：若确定第二网络设备的认证报文中的接入认证信息认证通过，则将该业务报文的报文标识与目标用户标识的对应关系下发至第一网络设备。
该发送模块032的功能实现还可以参考上述方法实施例中步骤306的相关描述。
可选地，该发送模块032还可以用于：
在将目标用户标识下发至第一网络设备之前，向第一网络设备下发用户标识与层级访问控制规则的对应关系，对应关系用于供第一网络设备基于目标用户标识确定至少一个层级访问控制规则。
该发送模块032的功能实现还可以参考上述方法实施例中步骤205、步骤301和步骤302的相关描述。
可选地，该确定模块031还可以用于：
在发送模块031将至少一个层级访问控制规则下发至第一网络设备之前，基于目标用户标识确定至少一个层级访问控制规则。
综上所述，本申请实施例提供了一种认证服务器，由于该认证服务器下发的第二网络设备的目标用户标识能够指示该第二网络设备在多级用户组中的层级位置，因此第一网络设备能够基于该第二网络设备的目标用户标识，确定出与至少一个层级的用户组一一对应的至少一个层级访问控制规则。由此，第一网络设备即可基于确定出的至少一个层级访问控制规则，对第二网络设备发送的业务报文进行精确地访问控制。在该访问控制的过程中，由于第一网络设备基于一个目标用户标识即可确定出一个或多个层级访问控制规则，因此实现了对业务报文的灵活且高效的访问控制。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上文描述的第一网络设备、认证服务器以及各模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
应理解的是，本申请实施例提供的第一网络设备和认证服务器还可以用专用集成电路(application-specific integrated circuit，ASIC)实现，或可编程逻辑器件(programmable logic device，PLD)实现，上述PLD可以是复杂程序逻辑器件(complex programmable logical device，CPLD)，现场可编程门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。也可以通过软件实现上述方法实施例提供的访问控制方法，当通过软件实现上述方法实施例提供的访问控制方法时，该第一网络设备和认证服务器中的各个模块也可以为软件模块。
图17是本申请实施例提供的一种访问控制设备的结构示意图，该访问控制设备可以为上述实施例提供的第一网络设备或认证服务器。参考图17，该访问控制设备可以包括：处理器401、存储器402、网络接口403和总线404。其中，总线404用于连接处理器401、存储器402和网络接口403。通过网络接口403(可以是有线或者无线)可以实现与其他设备之间的通信连接。存储器402中存储有计算机程序4021，该计算机程序4021用于实现各种应用功能。
应理解，在本申请实施例中，处理器401可以是CPU，该处理器401还可以是其他通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)、GPU或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。
存储器402可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
总线404除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线404。
其中，若该访问控制设备为第一网络设备，则处理器401可以用于执行计算机程序4021以实现上述方法实施例中由第一网络设备执行的步骤。若该访问控制设备为认证服务器，则处理器401可以用于执行计算机程序4021以实现上述方法实施例中由认证服务器执行的步骤。
图18是本申请实施例提供的一种第一网络设备的结构示意图，该第一网络设备可以应用于诸如图1或图2所示系统所示的系统中，且可以实现上述方法实施例中由第一网络设备执行的步骤。如图18所示，该第一网络设备可以包括：主控板501和至少一个接口板(接口板也称为线卡或业务板)，例如图18中示出了接口板502和接口板503。多个接口板的情况下可以包括交换网板504，该交换网板504用于完成各接口板之间的数据交换。
主控板501也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板501用于完成系统管理、设备维护和协议处理等功能。主控板501上主要有3类功能单元：系统管理控制单元、系统时钟单元和系统维护单元。主控板501包括：中央处理器5011和存储器5012。
接口板502和503也称为线路接口单元卡(line processing unit，LPU)、线卡(line card)或业务板，接口板用于提供各种业务接口(例如，POS接口、GE接口、ATM接口等)，并实现报文的转发。主控板501、接口板502以及接口板503之间通过系统总线与系统背板相连实现互通。接口板502上包括一个或多个中央处理器5021。中央处理器5021用于对接口板502进行控制管理并与主控板501上的中央处理器5011进行通信，以及用于报文的转发处理。接口板502上的转发表项存储器5024用于存储转发表项，网络处理器5022可以通过查找转发表项存储器5024中存储的转发表项进行报文的转发。
该接口板502包括一个或多个物理接口卡5023用于接收上一跳节点发送的报文，并根据中央处理器5021的指示向下一跳节点发送处理后的报文。具体实现过程这里不再逐一赘述。所述中央处理器5021的具体功能这里同样不再逐一赘述。
可以理解的是，本实施例中的第一网络设备包括多个接口板，采用分布式的转发机制，这种机制下，接口板503的结构与接口板502的结构基本相同，且接口板503上的操作与所述接口板502的操作基本相似，为了简洁，不再赘述。
此外，可以理解的是，图18中的接口板502中的中央处理器5021和/或网络处理器5022可以是专用硬件或芯片，如可以采用专用集成电路来实现上述功能，这种实现方式即为通常所说的转发面采用专用硬件或芯片处理的方式。在另外的实施方式中，所述中央处理器5021和/或网络处理器5022也可以采用通用的处理器，如通用的CPU来实现以上描述的功能。
此外应理解的是，主控板501可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，该设备的数据处理能力越强，提供的接口板越多。多块接口板的情况下，该多块接口板之间可以通过一块或多块交换网板通信，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，该设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，该设备包括多块接口板，可以通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的网络设备的数据接入和处理能力要大于集中式架构的设备。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
具体的实施例中，存储器5012和存储器5024可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only Memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘或者其它磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。接口板502中的存储器5024可以是独立存在，并通过通信总线与中央处理器5021相连接；或者，存储器5024也可以和中央处理器5021集成在一起。主控板501中的存储器5012可以是独立存在，并通过通信总线与中央处理器5011相连接；或者，存储器5012也可以和中央处理器5011集成在一起。
存储器5024用于存储程序代码，并由中央处理器5021来控制执行，存储器5012用于存储程序代码，并由中央处理器5011来控制执行。该中央处理器5021和/或中央处理器5011可以通过执行程序代码来实现上述实施例所提供的应用于第一网络设备的访问控制方法。例如，主控板501中的处理器5011可以用于基于目标用户标识确定至少一个层级访问控制规则，存储器5012可以用于存储数据，例如存储基准掩码链和用户标识等。接口板502和接口板503则可以用于与认证服务器和控制器之间交互数据，例如传输基准掩码链、用户标识、层级标识和第三对应关系等。
存储器5024和/或存储器5012存储的程序代码中可以包括一个或多个软件模块。这一个或多个软件模块可以为上述图14或图15所示实施例中提供的功能模块。
具体实施例中，该物理接口卡5023，可以是使用任何收发器一类的装置，用于与其它设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令， 当该计算机可读存储介质在计算机上运行时，使得计算机执行如上述方法实施例提供的由第一网络设备或认证服务器执行的访问控制方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述方法实施例提供的由第一网络设备或认证服务器执行的访问控制方法。
本申请实施例还提供了一种访问控制系统，如图1和图2所示，该系统包括：第一网络设备01和至少一个第二网络设备02。其中，该第一网络设备01可以为诸如图14、图15、图17或图18所示的第一网络设备，并且，该第一网络设备01可以实现上述方法实施例中由第一网络设备执行的步骤。
可选地，如图1和图2所示，该系统还可以包括：认证服务器03，该认证服务器03的结构可以参考图16或图17。并且，该认证服务器03可以实现上述方法实施例中由认证服务器执行的步骤。
上述实施例，可以全部或部分地通过软件、硬件、固件或其他任意组合来实现。当使用软件实现时，上述实施例可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载或执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以为通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集合的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质。半导体介质可以是固态硬盘(solid state drive，SSD)。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”、“第n”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。
本申请中术语“至少一个”的含义是指一个或多个，本申请中术语“多个”的含义是指两个或两个以上，例如，多个第二报文是指两个或两个以上的第二报文。本文中术语“系统”和“网络”经常可互换使用。
以上所述，仅为本申请的可选实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (45)

  1. 一种访问控制方法，其特征在于，应用于第一网络设备，所述方法包括：
    确定第二网络设备的目标用户标识，所述目标用户标识指示所述第二网络设备在多级用户组中的层级位置，所述多级用户组包括多个层级的用户组；
    基于所述目标用户标识确定至少一个层级访问控制规则，所述至少一个层级访问控制规则与所述多级用户组中的至少一个层级的用户组一一对应；
    基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  2. 根据权利要求1所述的方法，其特征在于，所述基于所述目标用户标识确定至少一个层级访问控制规则，包括：
    基于所述目标用户标识，确定至少一个层级的目标用户组，所述至少一个层级的目标用户组包括第一层级用户组；
    基于所述第一层级用户组，确定对应的第一层级访问控制规则，所述至少一个层级访问控制规则包括所述第一层级访问控制规则；
    所述基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制，包括：
    基于所述第一层级访问控制规则，对所述第二网络设备发送的业务报文进行第一访问控制。
  3. 根据权利要求2所述的方法，其特征在于，所述至少一个层级的目标用户组还包括第二层级用户组，所述第二层级用户组为所述第一层级用户组的上级用户组；
    所述基于所述目标用户标识确定至少一个层级访问控制规则，还包括：
    基于所述第二层级用户组，确定对应的第二层级访问控制规则，所述至少一个层级访问控制规则包括所述第二层级访问控制规则；
    所述基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制，还包括：
    基于所述第二层级访问控制规则，对所述第二网络设备发送的业务报文进行第二访问控制；
    其中，所述第二访问控制在所述第一访问控制之前或之后执行。
  4. 根据权利要求1所述的方法，其特征在于，所述基于所述目标用户标识确定至少一个层级访问控制规则，包括：
    基于所述目标用户标识，确定至少一个层级的目标用户组，所述至少一个层级的目标用户组包括第一层级用户组和第二层级用户组，所述第二层级用户组为所述第一层级用户组的上级用户组；
    所述基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制，包括：
    若未获取到所述第一层级用户组对应的层级访问控制规则，则基于所述第二层级用户组对应的层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述基于所述目标用户标识确定至少一个层级访问控制规则，包括：
    基于所述目标用户标识和目标掩码链确定标识链，所述标识链包括至少一个子标识，所述标识链指示所述第二网络设备在所述多级用户组中的层级位置，所述至少一个子标识与所述至少一个层级的用户组一一对应；
    基于所述至少一个子标识，确定至少一个层级访问控制规则；
    其中，所述目标掩码链包括与所述至少一个子标识一一对应的至少一个掩码，每个掩码用于指示对应的一个子标识的长度。
  6. 根据权利要求5所述的方法，其特征在于，所述标识链包括多个子标识；所述基于所述至少一个子标识，确定至少一个层级访问控制规则，包括：
    确定所述多个子标识所组成的多个子标识链，其中每个子标识链包括一个子标识或多个连续的子标识，不同子标识链包括的子标识的个数不同，且每个子标识链指示一个层级的用户组；
    确定每个子标识链指示的一个层级的用户组所对应的一个层级访问控制规则。
  7. 根据权利要求5或6所述的方法，其特征在于，在基于所述目标用户标识确定至少一个层级访问控制规则之前，所述方法还包括：
    接收认证服务器下发的所述目标掩码链；
    或者，接收所述认证服务器下发的所述目标用户标识的层级标识，并基于所述层级标识从基准掩码链中确定所述目标掩码链；
    其中，所述层级标识用于指示所述标识链所包括的子标识的个数，所述基准掩码链包括多个掩码，且所述基准掩码链包括的掩码的个数大于或等于所述标识链包括的子标识的个数。
  8. 根据权利要求1至7任一所述的方法，其特征在于，所述确定第二网络设备的目标用户标识，包括：
    向认证服务器上报所述第二网络设备的接入认证信息；
    接收所述认证服务器下发的所述第二网络设备的目标用户标识，所述目标用户标识是所述认证服务器在确定所述接入认证信息认证通过后下发的。
  9. 根据权利要求8所述的方法，其特征在于，在接收所述认证服务器下发的所述第二网络设备的目标用户标识之后，所述方法还包括：
    记录报文标识与所述目标用户标识的第一对应关系，所述报文标识由所述第二网络设备发送的报文所携带；
    基于所述第一对应关系，以及基于所述目标用户标识确定出的所述至少一个层级访问控制规则，记录所述报文标识与所述至少一个层级访问控制规则的第二对应关系；
    所述基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制，包括：
    在接收到所述第二网络设备发送的业务报文后，从所述第二对应关系中确定所述业务报 文的报文标识所对应的所述至少一个层级访问控制规则；
    基于所述至少一个层级访问控制规则，对所述业务报文进行访问控制。
  10. 根据权利要求1至7任一所述的方法，其特征在于，所述确定第二网络设备的目标用户标识，包括：
    接收认证服务器下发的报文标识与目标用户标识的第一对应关系；
    在接收到所述第二网络设备发送的业务报文后，基于所述业务报文的报文标识，从所述第一对应关系中确定所述第二网络设备的目标用户标识。
  11. 根据权利要求1至10任一所述的方法，其特征在于，所述基于所述目标用户标识确定至少一个层级访问控制规则，包括：
    基于用户标识与层级访问控制规则的第三对应关系，确定所述目标用户标识对应的所述至少一个层级访问控制规则。
  12. 根据权利要求11所述的方法，其特征在于，在基于所述目标用户标识确定至少一个层级访问控制规则之前，所述方法还包括：
    接收第三网络设备下发的所述用户标识与层级访问控制规则的第三对应关系。
  13. 根据权利要求1至12任一所述的方法，其特征在于，所述目标用户标识包括：一级子标识和二级子标识；
    其中，所述一级子标识用于指示所述至少一个层级的用户组中的一级用户组，所述一级子标识和所述二级子标识的组合用于指示所述至少一个层级的用户组中的二级用户组，且所述一级用户组为所述二级用户组的上一层级的用户组。
  14. 根据权利要求13所述的方法，其特征在于，所述目标用户标识还包括：三级子标识；
    所述一级子标识、所述二级子标识和所述三级子标识的组合用于指示所述至少一个层级的用户组中的三级用户组，且所述二级用户组为所述三级用户组的上一层级的用户组。
  15. 根据权利要求13或14所述的方法，其特征在于，所述第一网络设备属于所述一级用户组，所述第二网络设备属于所述二级用户组；
    所述基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制，包括：
    基于所述一级用户组对应的层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  16. 一种访问控制方法，其特征在于，应用于认证服务器，所述方法包括：
    确定第二网络设备的目标用户标识，所述目标用户标识指示第二网络设备在多级用户组中的层级位置，所述多级用户组包括多个层级的用户组；
    将所述目标用户标识和/或至少一个层级访问控制规则下发至第一网络设备，所述至少一个层级访问控制规则与所述多级用户组中的至少一个层级的用户组一一对应；
    其中，所述目标用户标识用于供所述第一网络设备确定所述至少一个层级访问控制规则，并基于所述至少一个层级访问控制规则对所述第二网络设备发送的业务报文进行访问控制。
  17. 根据权利要求16所述的方法，其特征在于，所述确定第二网络设备的目标用户标识，包括：
    接收所述第一网络设备发送的所述第二网络设备的接入认证信息；
    若确定所述第二网络设备的接入认证信息认证通过，则基于所述接入认证信息确定第二网络设备的目标用户标识。
  18. 根据权利要求16所述的方法，其特征在于，将所述目标用户标识下发至第一网络设备，包括：
    若确定所述第二网络设备的认证报文中的接入认证信息认证通过，则将所述认证报文的报文标识与所述目标用户标识的对应关系下发至第一网络设备。
  19. 根据权利要求16至18任一所述的方法，其特征在于，在将所述目标用户标识下发至第一网络设备之前，所述方法还包括：
    向所述第一网络设备下发用户标识与层级访问控制规则的对应关系，所述对应关系用于供所述第一网络设备基于所述目标用户标识确定所述至少一个层级访问控制规则。
  20. 根据权利要求16至18任一所述的方法，其特征在于，在将至少一个层级访问控制规则下发至第一网络设备之前，所述方法还包括：
    基于所述目标用户标识确定所述至少一个层级访问控制规则。
  21. 一种第一网络设备，其特征在于，所述第一网络设备包括：
    确定模块，用于确定第二网络设备的目标用户标识，所述目标用户标识指示所述第二网络设备在多级用户组中的层级位置，所述多级用户组包括多个层级的用户组；
    所述确定模块，还用于基于所述目标用户标识确定至少一个层级访问控制规则，所述至少一个层级访问控制规则与所述多级用户组中的至少一个层级的用户组一一对应；
    访问控制模块，用于基于所述至少一个层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  22. 根据权利要求21所述的第一网络设备，其特征在于，所述确定模块，用于：
    基于所述目标用户标识，确定至少一个层级的目标用户组，所述至少一个层级的目标用户组包括第一层级用户组；
    基于所述第一层级用户组，确定对应的第一层级访问控制规则，所述至少一个层级访问控制规则包括所述第一层级访问控制规则；
    所述访问控制模块，用于基于所述第一层级访问控制规则，对所述第二网络设备发送的业务报文进行第一访问控制。
  23. 根据权利要求22所述的第一网络设备，其特征在于，所述至少一个层级的目标用户组 还包括第二层级用户组，所述第二层级用户组为所述第一层级用户组的上级用户组；
    所述确定模块，还用于基于所述第二层级用户组，确定对应的第二层级访问控制规则，所述至少一个层级访问控制规则包括所述第二层级访问控制规则；
    所述访问控制模块，还用于基于所述第二层级访问控制规则，对所述第二网络设备发送的业务报文进行第二访问控制；
    其中，所述第二访问控制在所述第一访问控制之前或之后执行。
  24. 根据权利要求21所述的第一网络设备，其特征在于，所述确定模块，用于：
    基于所述目标用户标识，确定至少一个层级的目标用户组，所述至少一个层级的目标用户组包括第一层级用户组和第二层级用户组，所述第二层级用户组为所述第一层级用户组的上级用户组；
    所述访问控制模块，用于若未获取到所述第一层级用户组对应的层级访问控制规则，则基于所述第二层级用户组对应的层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  25. 根据权利要求21至24任一所述的第一网络设备，其特征在于，所述确定模块，用于：
    基于所述目标用户标识和目标掩码链确定标识链，所述标识链包括至少一个子标识，所述标识链指示所述第二网络设备在所述多级用户组中的层级位置，所述至少一个子标识与所述至少一个层级的用户组一一对应；
    基于所述至少一个子标识，确定至少一个层级访问控制规则；
    其中，所述目标掩码链包括与所述至少一个子标识一一对应的至少一个掩码，每个掩码用于指示对应的一个子标识的长度。
  26. 根据权利要求25所述的第一网络设备，其特征在于，所述标识链包括多个子标识；所述确定模块，用于：
    确定所述多个子标识所组成的多个子标识链，其中每个子标识链包括一个子标识或多个连续的子标识，不同子标识链包括的子标识的个数不同，且每个子标识链指示一个层级的用户组；
    确定每个子标识链指示的一个层级的用户组所对应的一个层级访问控制规则。
  27. 根据权利要求25或26所述的第一网络设备，其特征在于，所述第一网络设备还包括接收模块，所述接收模块，用于：
    在所述确定模块基于所述目标用户标识确定至少一个层级访问控制规则之前，接收认证服务器下发的所述目标掩码链；
    或者，接收所述认证服务器下发的所述目标用户标识的层级标识，并基于所述层级标识从基准掩码链中确定所述目标掩码链；
    其中，所述层级标识用于指示所述标识链所包括的子标识的个数，所述基准掩码链包括多个掩码，且所述基准掩码链包括的掩码的个数大于或等于所述标识链包括的子标识的个数。
  28. 根据权利要求21至26任一所述的第一网络设备，其特征在于，所述第一网络设备还包 括：
    发送模块，用于向认证服务器上报所述第二网络设备的接入认证信息；
    接收模块，用于接收所述认证服务器下发的所述第二网络设备的目标用户标识，所述目标用户标识是所述认证服务器在确定所述接入认证信息认证通过后下发的。
  29. 根据权利要求28所述的第一网络设备，其特征在于，所述确定模块还用于：
    在所述接收模块接收所述认证服务器下发的所述第二网络设备的目标用户标识之后，记录报文标识与所述目标用户标识的第一对应关系，所述报文标识由所述第二网络设备发送的报文所携带；
    基于所述第一对应关系，以及基于所述目标用户标识确定出的所述至少一个层级访问控制规则，记录所述报文标识与所述至少一个层级访问控制规则的第二对应关系；
    所述访问控制模块，用于：
    在接收到所述第二网络设备发送的业务报文后，从所述第二对应关系中确定所述业务报文的报文标识所对应的所述至少一个层级访问控制规则；
    基于所述至少一个层级访问控制规则，对所述业务报文进行访问控制。
  30. 根据权利要求21至26任一所述的第一网络设备，其特征在于，所述第一网络设备还包括接收模块，所述接收模块，用于接收认证服务器下发的报文标识与目标用户标识的第一对应关系；
    所述确定模块，用于在接收到所述第二网络设备发送的业务报文后，基于所述业务报文的报文标识，从所述第一对应关系中确定所述第二网络设备的目标用户标识。
  31. 根据权利要求21至26任一所述的第一网络设备，其特征在于，所述确定模块用于：
    基于用户标识与层级访问控制规则的第三对应关系，确定所述目标用户标识对应的所述至少一个层级访问控制规则。
  32. 根据权利要求31所述的第一网络设备，其特征在于，所述第一网络设备还包括：
    接收模块，用于在所述确定模块基于所述目标用户标识确定至少一个层级访问控制规则之前，接收第三网络设备下发的所述用户标识与层级访问控制规则的第三对应关系。
  33. 根据权利要求21至32任一所述的第一网络设备，其特征在于，所述目标用户标识包括：一级子标识和二级子标识；
    其中，所述一级子标识用于指示所述至少一个层级的用户组中的一级用户组，所述一级子标识和所述二级子标识的组合用于指示所述至少一个层级的用户组中的二级用户组，且所述一级用户组为所述二级用户组的上一层级的用户组。
  34. 根据权利要求33所述的第一网络设备，其特征在于，所述目标用户标识还包括：三级子标识；
    所述一级子标识、所述二级子标识和所述三级子标识的组合用于指示所述至少一个层级的用户组中的三级用户组，且所述二级用户组为所述三级用户组的上一层级的用户组。
  35. 根据权利要求33或34所述的第一网络设备，其特征在于，所述第一网络设备属于所述一级用户组，所述第二网络设备属于所述二级用户组；
    所述访问控制模块，用于基于所述一级用户组对应的层级访问控制规则，对所述第二网络设备发送的业务报文进行访问控制。
  36. 一种认证服务器，其特征在于，所述认证服务器包括：
    确定模块，用于确定第二网络设备的目标用户标识，所述目标用户标识指示第二网络设备在多级用户组中的层级位置，所述多级用户组包括多个层级的用户组；
    发送模块，用于将所述目标用户标识和/或至少一个层级访问控制规则下发至第一网络设备，所述至少一个层级访问控制规则与所述多级用户组中的至少一个层级的用户组一一对应；
    其中，所述目标用户标识用于供所述第一网络设备确定所述至少一个层级访问控制规则，并基于所述至少一个层级访问控制规则对所述第二网络设备发送的业务报文进行访问控制。
  37. 根据权利要求36所述的认证服务器，其特征在于，所述认证服务器还包括：
    接收模块，用于接收所述第一网络设备发送的所述第二网络设备的接入认证信息；
    所述确定模块，用于若确定所述第二网络设备的接入认证信息认证通过，则基于所述接入认证信息确定第二网络设备的目标用户标识。
  38. 根据权利要求36所述的认证服务器，其特征在于，所述发送模块，用于：
    若确定所述第二网络设备的认证报文中的接入认证信息认证通过，则将所述认证报文的报文标识与所述目标用户标识的对应关系下发至第一网络设备。
  39. 根据权利要求36至38任一所述的认证服务器，其特征在于，所述发送模块，还用于：
    在将所述目标用户标识下发至第一网络设备之前，向所述第一网络设备下发用户标识与层级访问控制规则的对应关系，所述对应关系用于供所述第一网络设备基于所述目标用户标识确定所述至少一个层级访问控制规则。
  40. 根据权利要求36至38任一所述的认证服务器，其特征在于，所述确定模块，还用于：
    在所述发送模块将至少一个层级访问控制规则下发至第一网络设备之前，基于所述目标用户标识确定所述至少一个层级访问控制规则。
  41. 一种网络设备，其特征在于，所述网络设备包括：存储器，处理器及存储在所述存储器上并能够在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如权利要求1至15任一所述的方法。
  42. 一种认证服务器，其特征在于，所述认证服务器包括：存储器，处理器及存储在所述存储器上并能够在所述处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如权利要求16至20任一所述的方法。
  43. 一种访问控制系统，其特征在于，所述系统包括：第一网络设备和至少一个第二网络设备，其中，所述第一网络设备为如权利要求21至35任一项所述的第一网络设备，或者为如权利要求41所述的网络设备。
  44. 根据权利要求43所述的系统，其特征在于，所述系统还包括：如权利要求36至40任一项所述的认证服务器，或者如权利要求42所述的认证服务器。
  45. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，所述指令由处理器执行以实现如权利要求1至20任一所述的方法。
PCT/CN2022/139553 2021-12-20 2022-12-16 访问控制方法、设备及系统 WO2023116566A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202111566942.2 2021-12-20
CN202111566942 2021-12-20
CN202210167699.5 2022-02-23
CN202210167699.5A CN116318744A (zh) 2021-12-20 2022-02-23 访问控制方法、设备及系统

Publications (1)

Publication Number Publication Date
WO2023116566A1 true WO2023116566A1 (zh) 2023-06-29

Family

ID=86776676

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/139553 WO2023116566A1 (zh) 2021-12-20 2022-12-16 访问控制方法、设备及系统

Country Status (2)

Country Link
CN (1) CN116318744A (zh)
WO (1) WO2023116566A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173679A1 (en) * 2010-01-08 2011-07-14 Microsoft Corporation Resource access based on multiple scope levels
JP2014119962A (ja) * 2012-12-17 2014-06-30 Mitsubishi Electric Corp 情報通信システム及び認証装置及び情報通信システムのアクセス制御方法及びアクセス制御プログラム
CN104113548A (zh) * 2014-07-24 2014-10-22 杭州华三通信技术有限公司 一种认证报文处理方法及装置
CN111711631A (zh) * 2020-06-17 2020-09-25 北京字节跳动网络技术有限公司 一种网络访问控制方法、装置、设备及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110173679A1 (en) * 2010-01-08 2011-07-14 Microsoft Corporation Resource access based on multiple scope levels
JP2014119962A (ja) * 2012-12-17 2014-06-30 Mitsubishi Electric Corp 情報通信システム及び認証装置及び情報通信システムのアクセス制御方法及びアクセス制御プログラム
CN104113548A (zh) * 2014-07-24 2014-10-22 杭州华三通信技术有限公司 一种认证报文处理方法及装置
CN111711631A (zh) * 2020-06-17 2020-09-25 北京字节跳动网络技术有限公司 一种网络访问控制方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN116318744A (zh) 2023-06-23

Similar Documents

Publication Publication Date Title
US10110671B2 (en) Method, system, and device for managing server hardware resources in a cloud scheduling environment
EP3334123B1 (en) Content distribution method and system
US20210218665A1 (en) Resilient network communication using selective multipath packet flow spraying
US8352604B2 (en) Distributed propagation of data in a wireless communication network
US9979656B2 (en) Methods, systems, and computer readable media for implementing load balancer traffic policies
WO2014190791A1 (zh) 一种网关设备身份设置的方法及管理网关设备
CN108259346B (zh) 一种等价路由表项建立方法和装置
JP5466723B2 (ja) ホスト提供システム及び通信制御方法
WO2014101777A1 (zh) 流表匹配方法和装置以及交换机
US7855972B2 (en) Creating, modifying and storing service abstractions and role abstractions representing one or more packet rules
CN112311674B (zh) 报文发送方法、装置及存储介质
JP6618610B2 (ja) ルーティング管理
WO2019015382A1 (zh) 一种别名管理方法及设备
US20210334270A1 (en) Information query method and apparatus, device, and storage medium
WO2023124309A1 (zh) 一种云原生upf信令面负载均衡选择方法及系统
MacDavid et al. Concise encoding of flow attributes in SDN switches
WO2019047939A1 (zh) 一种负载均衡方法、装置及业务编排器
JP2016116184A (ja) 網監視装置および仮想ネットワーク管理方法
WO2022222750A1 (zh) 报文转发方法、装置、网络设备及存储介质
CN102439948B (zh) 为基于以太网的多播通信确定组地址
US9680756B2 (en) Efficient in-band communication of quality-of-service policies between virtual classification devices and enforcement devices
WO2023116566A1 (zh) 访问控制方法、设备及系统
JP5610227B2 (ja) 計算機及び識別子管理方法
CN113727394A (zh) 共享带宽的实现方法及装置
WO2022166854A1 (zh) 一种数据查找方法、装置及集成电路

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22909880

Country of ref document: EP

Kind code of ref document: A1