WO2013107055A1

WO2013107055A1 - Method and apparatus for acquiring user information

Info

Publication number: WO2013107055A1
Application number: PCT/CN2012/070696
Authority: WO
Inventors: 傅瑜; 刘冰
Original assignee: 华为技术有限公司
Priority date: 2012-01-21
Filing date: 2012-01-21
Publication date: 2013-07-25
Also published as: CN103503423A

Abstract

Embodiments of the present invention provide a method for acquiring user information, which comprises: a CGN device querying, according to an external network IP address and an external network port of a client device, an internal network IP address and an internal network port of the client device; the CGN device sending, to an AAA server, a first query request comprising the internal network IP address and the internal network port, so that the AAA server queries, according to the internal network IP address and the internal network port, user information of the client device; and the CGN device receiving a first query response sent by the AAA server, the first query response being a response corresponding to the first query request and comprising the user information. The embodiments of the present invention also provide other methods and apparatuses. By means of the technical solutions of the embodiments of the present invention, user information of an internal network client device can be acquired from an external network side, thereby distinguishing internal network users.

Description

The present invention relates to communication technologies, and in particular, to a method and an apparatus for acquiring user information. BACKGROUND In order to implement a client device located on an intranet to access a network resource located in an external network, a carrier-grade network address translation (CGN) device transmits an intranet Internet Protocol (IP) address of the client device. Convert to an external network IP address.

The inventors found that the prior art has the following technical problems:

There may be multiple client devices in the intranet. The above multiple client devices use the same external IP address, which makes it impossible to distinguish intranet users from the external network.

Summary of the invention

The embodiment of the invention provides a method and a device for acquiring user information, which can obtain user information of the intranet client device from the external network side, thereby realizing the distinction between the intranet users.

In one aspect, a method for obtaining user information is provided, including:

The carrier-level network address translation CGN device queries the intranet IP address of the client device and the intranet of the client device according to the external network Internet Protocol IP address of the client device and the external network port of the client device. Port

The CGN device sends a first query request to the authentication and authorization charging AAA server, where the first query request includes the intranet IP address and the intranet port, so that the AAA server is configured according to the intranet IP address. An address and the intranet port, querying user information of the client device;

The CGN device receives the first query response sent by the AAA server, where the first query response is a response corresponding to the first query request, and the first query response includes the user information.

On the other hand, another method of obtaining user information is provided, including: The authentication and authorization charging AAA server receives the first query request sent by the CGN device, where the first query request includes the intranet IP address and the intranet port, and the first query request is obtained by:

Querying, by the AAA server, user information of the client device according to the intranet IP address and the intranet port;

The AAA server sends a first query response to the CGN device, where the first query response is a response corresponding to the first query request, and the first query response includes the user information.

On the other hand, another method of obtaining user information is provided, including:

The authentication and authorization charging AAA server sends a second query request to the carrier-level network address translation CGN device, where the second query request includes an external network Internet protocol IP address of the client device and an external network port of the client device. In order to facilitate the CGN device to query the internal network IP address of the client device and the internal network port of the client device on the CGN device according to the external network IP address and the external network port;

Receiving, by the AAA server, a second query response sent by the CGN device, where the second query response is a response corresponding to the second query request, where the second query response includes the intranet IP address and the Intranet port;

The AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

The carrier-level network address translation CGN device receives the second-query request sent by the AAA server, and the second query request includes the external network Internet protocol of the client device.

An IP address and an external network port of the client device; The CGN device queries the CGN device for the intranet IP address of the client device and the intranet port of the client device according to the external network IP address and the external network port;

The second query response sent by the CGN device to the AAA server, the second query response is a response corresponding to the second query request, and the second query response includes the intranet IP address and the An intranet port, so that the AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

The network management server sends a third query request to the carrier-level network address translation CGN device, where the third query request includes an external network Internet protocol IP address of the client device and an external network port of the client device, so as to facilitate the The CGN device queries the CGN device for the intranet IP address and the intranet port of the client device according to the external network IP address and the external network port;

Receiving, by the network management server, a third query response sent by the CGN device, where the third query response is a response corresponding to the third query request, where the third query response includes the intranet IP address and the Intranet port;

The network management server sends a fourth query request to the authentication and authorization charging AAA server, where the fourth query request includes the intranet IP address and the intranet port, so that the AAA server is configured according to the intranet IP address. And the intranet port, querying user information of the client device;

The network management server receives the fourth query response sent by the AAA server, the fourth query response is a response corresponding to the fourth query request, and the fourth query response includes the user information.

In another aspect, an apparatus for obtaining user information is provided, including:

a querying unit, configured to query an intranet IP address of the client device and the client according to an external network Internet Protocol IP address of the client device and an external network port of the client device The internal network port of the device;

a sending unit, configured to send a first query request to the authentication and authorization charging AAA server, where the first query request includes the intranet IP address and the intranet port, so that the AAA server is configured according to the intranet Querying the user information of the client device by using the IP address and the intranet port;

The receiving unit is configured to receive the first query response sent by the AAA server, where the first query response is a response corresponding to the first query request, and the first query response includes the user information.

In another aspect, another apparatus for obtaining user information is provided, including:

a sending unit, configured to send a second query request to the carrier-level network address translation CGN device, where the second query request includes an external network Internet Protocol IP address of the client device and an external network port of the client device, so that The CGN device queries the CGN device for the intranet IP address of the client device and the intranet port of the client device according to the external network IP address and the external network port;

a receiving unit, configured to receive a second query response sent by the CGN device, where the second query response is a response corresponding to the second query request, where the second query response includes the intranet IP address and the Said internal network port;

And a querying unit, configured to query user information of the client device according to the intranet IP address and the intranet port.

a first sending unit, configured to send a third query request to the carrier-level network address translation CGN device, where the third query request includes an external network Internet Protocol IP address of the client device and an external network port of the client device In order to facilitate the CGN device to query the internal network IP address and the intranet port of the client device on the CGN device according to the external network IP address and the external network port;

a first receiving unit, configured to receive a third query response sent by the CGN device, where the The third query response is a response corresponding to the third query request, where the third query response includes the intranet IP address and the intranet port;

a second sending unit, configured to send a fourth query request to the authentication and authorization charging AAA server, where the fourth query request includes the intranet IP address and the intranet port, so that the AAA server is configured according to the Querying the user information of the client device by using the network IP address and the internal network port;

The second receiving unit is configured to receive a fourth query response sent by the AAA server, where the fourth query response is a response corresponding to the fourth query request, and the fourth query response includes the user information.

It can be seen that the foregoing technical solution queries the CGN device for the intranet IP address and the intranet port of the client device according to the external network IP address of the client device and the external network port. According to the intranet IP address of the client device and the intranet port, the AAA server queries the user information of the client device. Through the above technical solution, the user information of the intranet client device can be obtained from the external network side, thereby realizing the distinction between the intranet users.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. The drawings are some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

1 is a network structure diagram of an application scenario of a method and apparatus for acquiring user information according to an embodiment of the present invention;

2 is a flowchart of a method for acquiring user information according to an embodiment of the present invention; FIG. 3 is a flowchart of another method for obtaining user information according to an embodiment of the present invention; FIG. 5 is a flowchart of another method for obtaining user information according to an embodiment of the present invention; FIG. 6 is another method for acquiring user information according to an embodiment of the present invention; Flow chart FIG. 7 is a schematic structural diagram of an apparatus for acquiring user information according to an embodiment of the present invention; FIG. 8 is a schematic structural diagram of another apparatus for acquiring user information according to an embodiment of the present invention; A schematic structural diagram of another apparatus for acquiring user information; FIG. 10 is a schematic structural diagram of another apparatus for acquiring user information according to an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of another apparatus for acquiring user information according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Embodiments of the present invention relate to a client device located on an intranet, a CGN device located on an intranet and an extranet, and an Authentication Authorization Accounting server (AAA server) located at an external network. The Internet may be an Internet Protocol version 4 (IPv4) network or an Internet Protocol version 6, IPv6 network. The internal network can be an IPv4 network or an IPv6 network. The above equipment will be explained below:

The client device is a device located on the intranet. In specific implementation, the client device may be a Personal Computer (PC), a Set Top Box (STB), a Customer Premises Equipment (CPE), or a Home Gateway (HG).

The CGN device can record the intranet IP address assigned by the Dynamic Host Configuration Protocol (DHCP) server to the client device. In addition, the CGN device can be based on a session initiated by the client device and within the client device The network IP address generates a first correspondence. The first correspondence includes an external network IP address, an intranet IP address, an external network port, and an intranet port of the client device. The first in the first correspondence is not used to limit the order.

The present invention does not limit the specific implementation manner in which the CGN device generates the first correspondence. The following provides an implementation of the CGN device to generate the first correspondence. Please refer to:

The user of the client device requests the operator of the external network to open the permission of the client device to access the external network resource.

The operator of the external network stores the account and password corresponding to the rights of the client device to access the external network resources in the AAA server. In addition, the operator of the external network records the user information of the user of the client device on the AAA server. The user information may be the identity card number of the user of the client device, the passport number, or the military officer number.

The user of the client device sends an access request to the Broadband Remote Access Server (BRAS). The BRAS sends an authentication request to the AAA server. The BRAS device and the CGN device can be the same device. The BRAS device and the CGN device may not be the same device. When the BRAS device is not the same device as the CGN device, the CGN device can log in and access the BRAS device. The AAA server authenticates the client device based on pre-stored accounts and passwords. If the authentication is passed, the client device can access the external network resources.

The BRAS device acts as a DHCP server and dynamically allocates intranet IP addresses to client devices. The client device sends a session establishment request to the application server of the external network. The IP header of the session establishment request carries the intranet IP address of the client device and the intranet port. The application server can be a web server, a video server, or an Internet Protocol television (IPTV) server.

After receiving the session establishment request, the CGN device determines the external network IP address and the external network port for the client device, and forwards the session establishment request through the external network port. The CGN device saves the CGN device to generate a first correspondence according to the intranet IP address, the intranet port, the external network IP address, and the external network port. Embodiments of the present invention relate to a Remote Authentication Dial In User Service (RADius). For details on the Radius protocol, see RFC2865.

Chapter 5 of the Radius Protocol defines 29 attributes (Attributes). Among them, the Radius protocol, Chapter 5, Section 5.1 defines the User-Name attribute. According to Section 5.1 of Chapter 5, the user information of the client device can be carried on the username attribute of the Radius protocol packet. Specifically, it can be carried in the String field of the username attribute.

Based on the Radius protocol, the embodiment of the present invention defines a new attribute, namely a User-Identity attribute. User information is carried in the user identity attribute. Table 1 shows a specific implementation of the user identity attribute:

Table 1: Schematic diagram of a user identity attribute

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Type I Length I string...

+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_ +_+_+_+_+_+_+_+_ In the above table, the user identity attribute consists of three fields, a Type field, a Length field, and a String field. For the format of the three fields, refer to the description of the format of the username attribute in Section 5.1 of Chapter 5 of the Radius Protocol. The value of the Type field in the User Identity attribute is a value other than the value of the Type field defined in Sections 5.1 through 5.29 of Chapter 5 of the Radius Protocol. The value of the length field in the user identity attribute is greater than or equal to 3, and the length used to identify the user identity attribute is greater than or equal to 3 bytes. A string field in the user identity attribute can be used to carry user information. The user information can be an ID number, a passport number, a military officer number, or a mobile number.

The embodiment of the present invention defines another new attribute, that is, the ground, based on the Radius protocol. Address and port properties. Table 2 shows a specific implementation of the address and port attributes: Table 2: A schematic diagram of the structure of the address and port attributes

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Type I Length |I|E| Reserved

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+ Internal network port I External network port

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+ Intranet IP address

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+ External IP address

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- +-+-+-+-+-+-+-+ The following describes the fields in Table 2:

Type field: A number used to identify the attribute, which is 8 bits long. Length field: Used to identify the length of the address and port attributes. The length of this field is 8 bits.

I field: Used to identify the type of the intranet IP address, 0 corresponds to IPv4, and 1 corresponds to IPv6. This field is 1 bit long.

E field: Used to identify the type of the external network IP address, 0 corresponds to IPv4, and 1 corresponds to IPv6. This field is 1 bit long.

Reserved field: Reserved. This field is 14 bits long.

Internal Port: The internal port. This field is 16 bits long.

External Port: External port. This field is 16 bits long.

Internal IP Address: The internal network IP address. This field is 128 bits long.

External IP Address: The IP address of the Xipu network. The length of this field is The embodiment of the invention provides a method and a device for acquiring user information, which can solve the technical problem that the intranet user cannot be distinguished from the external network side. FIG. 1 is a structural diagram of networking of an application scenario according to an embodiment of the present invention.

The networking diagram of Figure 1 includes two networks and four network elements. The two networks are the external network and the internal network. The four network elements are the client device 1, the CGN device, the AAA server, and the network management server. The client device 1 is located on the intranet. The CGN device is located at the edge of the internal network and at the edge of the external network. The AAA server and the network management server are located on the external network.

Embodiment 1:

This embodiment provides a method for obtaining user information, which can obtain user information of an intranet user from an external network side. The method for obtaining user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. Referring to FIG. 2, FIG. 2 is a flowchart of a method for obtaining user information according to this embodiment, where the method includes:

201. The CGN device queries the internal network IP address of the client device and the internal network port of the client device according to the external network IP address of the client device and the external network port of the client device.

In a specific implementation, the CGN device can query the intranet IP address and the intranet port of the client device in the first correspondence according to the external network IP address of the client device and the external network port.

202. The CGN device sends a first query request to the AAA server, where the first query request includes the intranet IP address and the intranet port, so that the AAA server queries according to the intranet IP address and the intranet port. User information for this client device.

The first query request is used to query the AAA server for user information of the client device.

The first query request may be a Radius protocol message. In a specific implementation, the address and port attributes may be included in the corresponding Radius protocol packet of the first query request. The intranet IP address of the client device is carried in the intranet IP address field of the address and port attributes. The intranet port of the client device carries the intranet port field of the address and port attributes.

203. The CGN device receives a first query response sent by the AAA server, where the first check is performed. The response response is a response corresponding to the first query request, and the first query response includes the user information. The first query response is used to send user information of the client device to the CGN device.

The first query response may be a Radius protocol message. In a specific implementation, the user name attribute may be included in the corresponding Radius protocol packet of the first query request. User information is carried in the string field of the username attribute.

In addition, when the first query response is a Radius protocol message, the Radius protocol message may include a user identity attribute. User information is carried in the user identity attribute. In the specific implementation, the user information is carried in the string field of the user identity attribute. The user information can be an ID number, a passport number, a military officer number, or a mobile number.

It can be seen that, by using the method for obtaining user information provided by the embodiment, the CGN device queries the intranet IP address and the intranet port of the client device according to the external network IP address of the client device and the external network port. The user information of the client device is queried in the AAA server according to the intranet IP address of the client device and the intranet port. With the technical solution provided in this embodiment, the user information of the intranet client device can be obtained from the external network side, so that the intranet user can be distinguished.

Optional,

The first query request message is a first Radius protocol message, and the first query response message is a second Radius protocol message.

In the specific implementation, the first Radius protocol packet is a Radius protocol packet. The second Radius protocol packet is a Radius protocol packet. The "first" and "second" in the first Radius protocol packet and the second Radius protocol packet are used to distinguish the first Radius protocol packet from the second Radius protocol packet, and are not used to limit the sequence.

Optional,

The intranet IP address and the intranet port are carried in the address and port attributes of the first Radius protocol packet, and the user information is carried on the username attribute or the user identity attribute of the second Radius protocol packet. Embodiment 2:

This embodiment provides a method for obtaining user information, which can obtain user information of an intranet user from an external network side. The method for obtaining user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. Referring to FIG. 3, FIG. 3 is a flowchart of a method for obtaining user information according to this embodiment, where the method includes:

301. The AAA server receives a first query request sent by the CGN device, where the first query request includes the intranet IP address and the intranet port, and the first query request is obtained by: a carrier-level network address translation CGN device. According to the external network Internet Protocol IP address of the client device and the external network port of the client device, the intranet IP address of the client device and the intranet port of the client device are queried.

For specific implementation of 301, please refer to 201 and 202 in the first embodiment.

302. The AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

For specific implementation of 302, refer to 202 in the first embodiment.

303. The AAA server sends a first query response to the CGN device, where the first query response is a response corresponding to the first query request, where the first query response includes the user information.

For specific implementation of 303, refer to 203 in the first embodiment.

Optional,

The first query request is a first remote user dialing authentication service Radius protocol packet, and the first query response packet is a second Radius protocol packet. In the specific implementation, the first Radius protocol packet is a Radius protocol packet. The second Radius protocol packet is a Radius protocol packet. The first and second addresses in the first Radius protocol packet and the second Radius protocol packet are used to distinguish the first Radius protocol packet from the second Radius protocol packet, and are not used to limit the sequence.

Optional,

The intranet IP address and the intranet port are carried on the address and port attributes of the first Radius protocol packet, and the user information is carried on the username attribute or the user identity attribute of the second Radius protocol packet.

Embodiment 3:

This embodiment provides a method for obtaining user information, which can obtain user information of an intranet user from an external network side. The method for obtaining user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. Referring to FIG. 4, FIG. 4 is a flowchart of a method for acquiring user information according to this embodiment, where the method includes:

401. The AAA server sends a second query request to the CGN device, where the second query request includes an external network IP address of the client device and an external network port of the client device, so as to facilitate the

The CGN device queries the CGN device for the intranet IP address of the client device and the intranet port of the client device according to the external network IP address and the external network port.

The second query request is used to query the CGN for the intranet IP address of the client device and the intranet port. The "second" in the second query request is not used to limit the order.

The second query request may be a Radius protocol message. In a specific implementation, the address and port attributes may be included in the corresponding Radius protocol packet of the second query request. The external network IP address of the client device is carried in the external network IP address field of the address and port attributes. The external network port of the client device carries the external network port field of the address and port attributes.

402. The AAA server receives a second query response sent by the CGN device, where the second query is performed. The response response is a response corresponding to the second query request, and the second query response includes the intranet IP address and the intranet port.

The second query response is used to send the intranet IP address of the client device and the intranet port to the AAA server. In specific implementation, the intranet IP address of the client device is carried in the intranet IP address field of the address and port attributes. The intranet port of the client device is carried in the intranet port field of the address and port attributes. The "second" in the second query response is not used to qualify the order.

403. The AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

In specific implementation, the user information of the client device may be an identity card number, a passport number, a military officer number, or a mobile phone number.

Optional,

The second query request is a first Radius protocol message, and the second query response is a second Radius protocol message.

The first and second Radius protocol packets in the first Radius protocol packet and the second Radius protocol packet are used to distinguish the first Radius protocol packet from the second Radius protocol packet, and are not used to limit the sequence.

Optional,

The external network IP address and the external network port are carried on the address and port attributes of the first Radius protocol packet, and the internal network IP address and the address and port attribute of the second Radius protocol packet are carried by the internal network port. on. Embodiment 4:

This embodiment provides a method for obtaining user information, which can obtain user information of an intranet user from an external network side. The method for obtaining user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. Referring to FIG. 5, FIG. 5 is a flowchart of a method for obtaining user information according to this embodiment, where the method includes:

501. The CGN device receives a second query request sent by the AAA server, where the second query request includes an external network IP address of the client device and an external network port of the client device.

For specific implementation of 501, refer to 401 in the third embodiment.

502. The CGN device queries the CGN device for the intranet IP address of the client device and the intranet port of the client device according to the external network IP address and the external network port.

For specific implementation of 502, please refer to 401 in the third embodiment.

503. The second query response sent by the CGN device to the AAA server, where the second query response is a response corresponding to the second query request, where the second query response includes the intranet IP address and the intranet port, so that The AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

For specific implementation of 503, please refer to 402 and 403 in Embodiment 3.

Optional,

The first Radius protocol message and the second Radius protocol message are "first" and "second," It is used to distinguish between the first Radius protocol packet and the second Radius protocol packet, and is not used to limit the sequence.

Optional,

The external network IP address and the external network port are carried on the address and port attributes of the first Radius protocol packet, and the internal network IP address and the address and port attribute of the second Radius protocol packet are carried by the internal network port. on.

Embodiment 5:

This embodiment provides a method for obtaining user information, which can obtain user information of an intranet user from an external network side. The method for obtaining user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. Referring to FIG. 6, FIG. 6 is a flowchart of a method for acquiring user information according to this embodiment, where the method includes:

601. The network management server sends a third query request to the CGN device, where the third query request includes an external network IP address of the client device and an external network port of the client device, so as to facilitate the

The CGN device queries the CGN device for the intranet IP address and the intranet port of the client device according to the external network IP address and the external network port.

The third query request is used to query the CGN for the intranet IP address of the client device and the intranet port. The "third" in the third query request is not used to limit the order.

The third query request may be an application layer protocol message. The application layer protocol can be a simple object access protocol (SOAP).

Optionally, the external network IP address of the client device and the external network port can be carried in the payload of the SOAP packet.

The network management server can identify that the third query request is sent by the CGN device for querying the intranet IP address of the client device and the intranet port according to the external network IP address of the client device and the external network port. In a specific implementation, the CGN device can perform the query in the first correspondence. 602. The network management server receives a third query response sent by the CGN device, where the third query response is a response corresponding to the third query request, where the third query response includes the intranet IP address and the intranet port.

The third query response is used to send the intranet IP address of the client device and the intranet port to the network management server. The "third" in the third query response is not used to limit the order.

The third query response may be an application layer protocol message. The application layer protocol can be SOAP. Optionally, the intranet IP address of the client device and the intranet port can be carried in the payload of the SOAP message.

603. The network management server sends a fourth query request to the AAA server, where the fourth query request includes the intranet IP address and the intranet port, so that the AAA server queries the intranet IP address and the intranet port. User information of the client device.

The fourth query request is used to query the AAA server for user information of the client device. The "fourth" in the fourth inquiry request is not used to limit the order.

The fourth query request may be a Radius protocol message. In a specific implementation, the address and port attributes may be included in the corresponding Radius protocol packet of the fourth query request. The intranet IP address of the client device is carried in the intranet IP address field of the address and port attributes. The intranet port of the client device carries the intranet port field of the address and port attributes.

604. The network management server receives a fourth query response sent by the AAA server, where the fourth query response is a response corresponding to the fourth query request, where the fourth query response includes the user information.

The fourth query response is used to send the user information of the client device to the network management server. The "fourth" in the fourth query response is not used to limit the order.

The fourth query response may be a Radius protocol message. In a specific implementation, the Radius protocol packet corresponding to the fourth query request includes a username attribute. User information can be carried in a string field of the username attribute.

In addition, when the fourth query response is a Radius protocol packet, the Radius protocol packet may be To include the user identity attribute. User information can be hosted in the user identity attribute. In specific implementation, the user information is carried in a string field of the user identity attribute. The user information can be an ID number, a passport number, a military officer number, or a mobile number.

Optional,

The fourth query request is a first Radius protocol message, and the fourth query response is a second Radius protocol message.

In the specific implementation, the first Radius protocol packet is a Radius protocol packet. The second Radius protocol packet is a Radius protocol packet. The first and second Radius protocol packets in the first Radius protocol packet and the second Radius protocol packet are used to distinguish the first Radius protocol packet from the second Radius protocol packet, and are not used to limit the sequence.

Optional,

The third query request is a first application layer protocol message, and the fourth query response is a second application layer protocol message.

In a specific implementation, the first application layer protocol packet is an application layer protocol packet. The second application layer protocol packet is an application layer protocol packet. The first application layer protocol packet and the second application layer protocol packet are used to distinguish the first application layer protocol packet from the second application layer protocol packet. Text, not used to limit the order.

Embodiment 6

This embodiment provides an apparatus for acquiring user information, which can obtain user information of an intranet user from an external network side. The apparatus for acquiring user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. In a specific implementation, the device for obtaining user information provided by this embodiment may be the CGN device in FIG. Referring to FIG. 7, FIG. 7 is a schematic structural diagram of an apparatus for acquiring user information according to this embodiment, where the apparatus includes:

The query unit 701 is configured to query an intranet IP address of the client device and an intranet port of the client device according to the external network Internet Protocol IP address of the client device and the external network port of the client device.

For specific implementation of the query unit 701, refer to 201 in the first embodiment.

The sending unit 702 is configured to send a first query request to the authentication and authorization charging AAA server, where the first query request includes the intranet IP address and the intranet port, so that the AAA server according to the intranet IP address and the The intranet port queries the user information of the client device.

When the sending unit 702 is specifically implemented, refer to 202 in the first embodiment.

The receiving unit 703 is configured to receive a first query response sent by the AAA server, where the first query response is a response corresponding to the first query request, where the first query response includes the user

When the receiving unit 703 is specifically implemented, refer to 203 in the first embodiment.

It can be seen that, by using the device for obtaining user information provided by the embodiment, the CGN device queries the intranet IP address and the intranet port of the client device according to the external network IP address of the client device and the external network port. The user information of the client device is queried in the AAA server according to the intranet IP address of the client device and the intranet port. With the technical solution provided in this embodiment, the user information of the intranet client device can be obtained from the external network side, so that the intranet user can be distinguished.

Example 7 This embodiment provides an apparatus for acquiring user information, which can obtain user information of an intranet user from an external network side. The apparatus for acquiring user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. The device for obtaining user information provided in this embodiment may be the AAA server in FIG. 1 . Referring to FIG. 8, FIG. 8 is a schematic structural diagram of an apparatus for acquiring user information according to this embodiment, where the apparatus includes:

The receiving unit 801 is configured to receive a first query request sent by the CGN device, where the first query request includes the intranet IP address and the intranet port, and the first query request is obtained by: a carrier-level network address translation The CGN device queries the internal network IP address of the client device and the intranet port of the client device according to the external network Internet Protocol IP address of the client device and the external network port of the client device.

For details of the receiving unit 801, refer to 301 in the second embodiment.

The query unit 802 is configured to query user information of the client device according to the intranet IP address and the intranet port.

For the specific implementation of the query unit 802, refer to 302 in the second embodiment.

The sending unit 803 is configured to send a first query response to the CGN device, where the first query response is a response corresponding to the first query request, where the first query response includes the user information.

For details of the sending unit 803, refer to 303 in the second embodiment.

Example eight

This embodiment provides an apparatus for acquiring user information, which can obtain user information of an intranet user from an external network side. The device for obtaining user information provided in this embodiment can be applied to FIG. 1 In the networking structure shown. The device for obtaining user information provided in this embodiment may be the AAA server in FIG. 1 . Referring to FIG. 9, FIG. 9 is a schematic structural diagram of an apparatus for acquiring user information according to this embodiment, where the apparatus includes:

The sending unit 901 is configured to send a second query request to the CGN device, where the second query request includes an external network Internet Protocol IP address of the client device and an external network port of the client device, so that the CGN device is configured according to the external The IP address of the network and the external network port are queried on the CGN device for the intranet IP address of the client device and the intranet port of the client device.

When the sending unit 901 is specifically implemented, refer to 401 in the third embodiment.

The receiving unit 902 is configured to receive a second query response sent by the CGN device, where the second query response is a response corresponding to the second query request, where the second query response includes the intranet IP address and the intranet port.

When the receiving unit 902 is specifically implemented, refer to 402 in the third embodiment.

The query unit 903 is configured to query the user information of the client device according to the intranet IP address and the intranet port.

For the specific implementation of the query unit 903, refer to 403 in the third embodiment.

Example nine

This embodiment provides an apparatus for acquiring user information, which can obtain user information of an intranet user from an external network side. The apparatus for acquiring user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. The device for obtaining user information provided by this embodiment may be the CGN device in FIG. 1 . Referring to FIG. 10, FIG. 10 is a method for acquiring a user provided in this embodiment. A schematic diagram of the structure of the device, the device comprising:

The receiving unit 1001 is configured to receive a second query request sent by the AAA server by the authentication and authorization charging, where the second query request includes an external network Internet protocol IP address of the client device and an external network port of the client device.

For specific implementation of the receiving unit 1001, refer to 501 in the fourth embodiment.

The query unit 1002 is configured to query, on the CGN device, an intranet IP address of the client device and an intranet port of the client device according to the external network IP address and the external network port.

For specific implementation of the query unit 1002, refer to 502 in the fourth embodiment.

The sending unit 1003 is configured to send a second query response to the AAA server, where the second query response is a response corresponding to the second query request, where the second query response includes the intranet IP address and the intranet port. The AAA server queries the user information of the client device according to the intranet IP address and the intranet port.

For specific implementation of the sending unit 1003, refer to 503 in the fourth embodiment.

Example ten

This embodiment provides an apparatus for acquiring user information, which can obtain user information of an intranet user from an external network side. The apparatus for acquiring user information provided in this embodiment may be applied to the networking structure shown in FIG. 1. In a specific implementation, the device for obtaining user information provided in this embodiment may be the network management server in FIG. Referring to FIG. 11, FIG. 11 is a schematic structural diagram of an apparatus for acquiring user information according to this embodiment, where the apparatus includes:

The first sending unit 1101 is configured to send a third query request to the CGN device, where the third query The request includes the external network Internet Protocol IP address of the client device and the external network port of the client device, so that the CGN device queries the CGN device according to the external network IP address and the external network port. Intranet IP address and intranet port.

When the first sending unit 1101 is specifically implemented, refer to 601 in the fifth embodiment.

The first receiving unit 1102 is configured to receive a third query response sent by the CGN device, where the third query response is a response corresponding to the third query request, where the third query response includes the intranet

IP address and the intranet port.

For specific implementation of the first receiving unit 1102, refer to 602 in the fifth embodiment.

a second sending unit 1103, configured to send a fourth query request to the AAA server, where the fourth query request includes the intranet IP address and the intranet port, so that the AAA server according to the intranet IP address and the intranet port , query the user information of the client device.

When the second sending unit 1103 is specifically implemented, refer to 603 in the fifth embodiment.

The second receiving unit 1104 is configured to receive a fourth query response sent by the AAA server, where the fourth query response is a response corresponding to the fourth query request, where the fourth query response includes the user information.

When the second receiving unit 1104 is specifically implemented, refer to 604 in the fifth embodiment.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. Professional technicians can make it for each specific application The described functionality is implemented in different ways, but such implementation should not be considered to be beyond the scope of the invention.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit may be only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined. Either can be integrated into another system, or some features can be ignored, or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e., may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a USB flash drive, a mobile hard disk, and a read only memory (abbreviated as ROM, English full name Read-Only Memory), random access memory (abbreviated as RAM, English full name called Random Access Memory), disk or optical disc and other media that can store program code.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

A method for obtaining user information, comprising:

2. The method of claim 1 wherein:

The first query request is a first remote user dialing authentication service Radius protocol message, and the first query response message is a second Radius protocol message.

3. The method of claim 2, wherein

The internal network IP address and the internal network port are carried on the address and the port attribute of the first Radius protocol packet, and the user information is carried on the user name attribute of the second Radius protocol packet or the user On the identity attribute.

4. A method for obtaining user information, comprising:

The AAA server receives the first query request sent by the CGN device, where the first query request includes the intranet IP address and the intranet port, and the first query request is obtained by:

The carrier-level network address translation CGN device queries the intranet IP address of the client device and the intranet of the client device according to the external network Internet Protocol IP address of the client device and the external network port of the client device. port; Querying, by the AAA server, user information of the client device according to the intranet IP address and the intranet port;

5. The method of claim 4 wherein:

6. The method of claim 5 wherein:

7. A method for obtaining user information, comprising:

8. The method of claim 7 wherein:

The second query request is a first remote user dialing authentication service Radius protocol message, and the second query response is a second Radius protocol message.

9. The method of claim 8 wherein:

The external network IP address and the external network port are carried on the address and port attribute of the first Radius protocol packet, and the internal network IP address and the internal network port are carried in the second Radius protocol The address and port properties are on.

10. A method for obtaining user information, comprising:

The carrier-level network address translation CGN device receives the second query request sent by the authentication and authorization charging AAA server, where the second query request includes the external network Internet Protocol IP address of the client device and the external network port of the client device. ;

The CGN device queries the CGN device for the intranet IP address of the client device and the intranet port of the client device according to the external network IP address and the external network port;

11. The method of claim 10, wherein

12. The method of claim 11 wherein:

13. A method for obtaining user information, comprising:

The network management server sends a third query request to the carrier-level network address translation CGN device, where the third query request includes an external network Internet protocol IP address of the client device and an external network port of the client device, so as to facilitate the The CGN device is based on the external network IP address and the An external network port, querying, on the CGN device, an intranet IP address and an intranet port of the client device;

14. The method of claim 13 wherein:

The fourth query request is a first remote user dialing authentication service Radius protocol message, and the fourth query response is a second Radius protocol message.

15. The method of claim 14 wherein:

The internal network IP address and the internal network port are carried on the address and the port attribute of the first Radius protocol packet, and the user information is carried in the user name attribute of the first Radius protocol packet or the user. On the identity attribute.

16. An apparatus for obtaining user information, comprising:

a querying unit, configured to query an intranet IP address of the client device and an intranet port of the client device according to an external network Internet protocol IP address of the client device and an external network port of the client device;

a sending unit, configured to send a first query request to the authentication and authorization charging AAA server, where the first query request includes the intranet IP address and the intranet port, so that the AAA server is configured according to the intranet Querying the client device by using an IP address and the intranet port Household information;

17. An apparatus for obtaining user information, comprising:

18. An apparatus for obtaining user information, comprising:

a first receiving unit, configured to receive a third query response sent by the CGN device, where the third query response is a response corresponding to the third query request, where the third query response includes the intranet IP address And the intranet port;

a second sending unit, configured to send a fourth query request to the authentication and authorization charging AAA server, where the fourth query request includes the intranet IP address and the intranet port, so as to facilitate the The AAA server queries the user information of the client device according to the intranet IP address and the intranet port;