WO2021077996A1 - Nat security and access control method, apparatus and device, and storage medium - Google Patents

Abstract

Provided in the embodiments of the present application are an NAT security and access control method, apparatus and device, and storage medium. When a user-side device sends a protocol access message, the sent protocol access message comprises the information to be authenticated. After receiving the protocol access message sent by the user-side device, an access device performs security authentication on the protocol access message according to the information to be authenticated in the protocol access message, and performs NAT processing on the protocol access message when the authentication passes.

Description

NAT security and access control method, device, equipment and storage medium

Cross-references to related applications

This application is filed based on a Chinese patent application with an application number of 201911002736.1 and an application date of October 21, 2019, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated into this application by way of introduction.

Technical field

This application relates to the field of network communications, and in particular to a NAT (Network Address Translation, network address translation) security and access control method, device, equipment, and storage medium.

Background technique

Telecom operators require the Layer 2 network access equipment of equipment providers to support MPNAT (Multi Protocol Network Address Translation) function. In this way, through NAT processing, the bureau equipment can remotely manage the user-side equipment in a variety of ways. For example, the office equipment can remotely log in to Telnet to manage the configuration files of the user-side equipment, and the user-side equipment can also download the latest version or configuration file from the central office equipment.

In related technologies, for access messages (such as various protocol control messages) sent from user-side devices, the access device does not perform security verification on these access messages after receiving these access messages, and directly checks These access messages are processed by NAT to generate a configuration table entry and two forwarding table entries. One of the two forwarding table entries is a software forwarding table entry, and the other is a hardware forwarding table entry. Software entries are used for NAT translation of control link packets, and hardware entries are used for NAT translation of data link packets; on the one hand, this approach has security risks; on the other hand, due to the hardware resources and software entries of the access device Resources are limited. When the user-side device has continuous illegal access packet attacks, it will occupy a large amount of forwarding entry resources of the access device until the forwarding entry resources are exhausted, and the consequences will not only squeeze normal users If the network bandwidth of the access device is invalid, the MPNAT function of the access device fails, and the central office equipment cannot manage the user-side equipment; more serious, private network users may maliciously damage the system files of the central office equipment, causing more serious damage to the central office equipment. Security risks.

Summary of the invention

The embodiments of the present application provide a method, device, device, and storage medium for NAT security and access control.

The embodiment of the application provides a network address translation NAT security control method, including: receiving a protocol access message carrying information to be authenticated sent by a user-side device; and performing security authentication on the protocol access message according to the information to be authenticated ; When the security authentication is passed, NAT processing is performed on the protocol access message.

An embodiment of the present application also provides an access control method, including: generating a protocol access message, the protocol access message including information to be authenticated; and sending the protocol access message to an access device supporting the NAT function.

An embodiment of the present application also provides an access control device, including: a message generation module, configured to generate a protocol access message, the protocol access message includes information to be authenticated; a message sending module, configured to transfer the protocol The access message is sent to the access device that supports the NAT function.

An embodiment of the present application also provides an access device that supports a NAT function, and includes a first processor, a first memory, and a first communication bus; the first communication bus is used to connect the first The processor is connected to the first memory; the first processor is configured to execute the first computer program stored in the first memory to implement the steps of the NAT security control method as described above.

An embodiment of the present application also provides a user-side device, including a second processor, a second memory, and a second communication bus; the second communication bus is used to connect the second processor and the second memory; The second processor is configured to execute the second computer program stored in the second memory, so as to implement the steps of the access control method as described above.

An embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a first computer program, and the first computer program can be executed by a first processor to implement the NAT security described above The steps of the control method; or, the computer-readable storage medium stores a second computer program, and the second computer program can be executed by the second processor to implement the steps of the access control method as described above.

Other features of this application and corresponding beneficial effects are described in the latter part of the specification, and it should be understood that at least part of the beneficial effects will become apparent from the description in the specification of this application.

Description of the drawings

FIG. 1 is a schematic flowchart of a NAT security control method according to Embodiment 1 of this application;

FIG. 2 is a schematic diagram of a security authentication process for protocol access messages according to Embodiment 1 of the application;

FIG. 3 is a schematic diagram of a security authentication process according to Embodiment 1 of this application;

FIG. 4 is a schematic diagram of the process of authenticating authentication content according to Embodiment 1 of the application;

FIG. 5 is a schematic diagram of the process of sending a protocol access message according to the first embodiment of the application;

6 is a schematic structural diagram of a NAT security control device according to Embodiment 2 of the application;

FIG. 7 is a schematic structural diagram of an access control device according to Embodiment 2 of this application;

FIG. 8 is a schematic diagram of the networking structure of Embodiment 2 of this application;

FIG. 9 is a schematic diagram of a security authentication process according to Embodiment 2 of this application;

FIG. 10 is a schematic diagram of the structure of an access device according to Embodiment 3 of this application;

FIG. 11 is a schematic structural diagram of a user-side device according to Embodiment 3 of this application.

Detailed ways

In order to make the objectives, technical solutions, and advantages of the present application clearer, the following further describes the embodiments of the present application in detail through specific implementations in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the application, and not used to limit the application.

Example one:

In the related technology, the access device directly performs NAT processing on the protocol access message received in the related technology without performing security verification, which not only causes the access device resources to be maliciously occupied, but also gives the access device and the central office equipment To cause security risks, this embodiment provides a NAT security control method. When a user-side device sends a protocol access message, the sent protocol access message includes information to be authenticated, and the access device receives the message sent by the user-side device. After the protocol access message, the security authentication of the protocol access message is performed according to the information to be authenticated in the protocol access message. Only when the authentication is passed, the NAT processing is performed on the protocol access message, which ensures that only those who have legal Only the protocol access message sent by the user-side device of the identity can be processed normally, which not only saves the software and hardware table item resources of the access device, but also ensures the security of the access device and the central office device.

For ease of understanding, this embodiment is described below with reference to the NAT security control method shown in FIG. 1 as an example. Please refer to FIG. 1, which includes:

S101: Receive a protocol access message carrying information to be authenticated sent by a user-side device.

It should be understood that the user-side device in this embodiment can be any user-side device connected to an access device that supports the NAT function. For example, the user-side device can be, but not limited to, GPON (Gigabit-Capable Passive Optical Networks, Gigabit passive optical network) ONU (Optical Network Unit), EPON (Ethernet Passive Optical Network, Ethernet passive optical network) ONU, ZXDSL 9806H (ZXDSL 9806H is for FTTx application scenarios ( A general term for various optical fiber communication networks, where x represents the destination of the optical fiber line) tailored, small-capacity full-service access platform), MDU (Multi-Tenant Unit, multi-tenant unit).

It should be understood that the access device in this embodiment may be a variety of access devices that support the NAT function, such as an OLT (optical line terminal, optical line terminal) and various switches that support the NAT function.

In this embodiment, the protocol access message sent by the user-side device may include, but is not limited to, various protocol control messages, such as FTP (File Transfer Protocol, file transfer protocol) control messages.

In this embodiment, the information to be authenticated included in the protocol access message sent by the user-side device may be authentication information pre-configured with the user-side device, or it may be the user-side device generating rules based on preset authentication information And the generated authentication information. The specific authentication information acquisition method can be flexibly set according to specific application scenarios.

S102: Perform security authentication on the received protocol access message according to the to-be-authenticated information in the protocol access message.

In this embodiment, after the access device receives the protocol access message sent by the user-side device, it extracts the information to be authenticated from the protocol access message, and then the access device uses the information to be authenticated based on the set authentication Rules for safety certification. And it should be understood that the authentication rules in this embodiment can also be flexibly set according to specific needs.

S103: Perform NAT processing on the protocol access message received when the security authentication is passed.

In this embodiment, after passing the security authentication of the received protocol access message, the access device performs normal NAT processing on the protocol access message to generate one configuration table entry and two forwarding entries, and two forwarding tables One of the forwarding entries is a software forwarding entry, and the other is a hardware forwarding entry. The software table entry is used to control the NAT translation of link messages, and the hardware table entry is used to control the NAT translation of data link messages. The specific NAT processing can adopt various NAT processing methods, which will not be repeated here.

In some examples of this embodiment, when the security authentication fails, the access device may discard the received protocol access message, or put it in the idle time period for processing, or remind the user to proceed according to the instructions issued by the user. Corresponding processing; in some examples of this embodiment, the access device may also perform corresponding alarm marking or alarm processing on the received protocol access message.

As mentioned above, in this embodiment, the information to be authenticated included in the protocol access message sent by the user-side device may be authentication information pre-configured with the user-side device, or it may be the user-side device according to a preset The authentication information generated by the authentication information generation rules. For ease of understanding, this embodiment is described below with several example situations.

In some examples of this embodiment, the corresponding first authentication information generation algorithm can be set on the user-side device. When the user-side device sends the protocol access message, it can generate the corresponding first authentication information generation algorithm according to the first authentication information generation algorithm. The authentication information is also carried in the protocol access message. On the access device side, a second authentication information generation algorithm corresponding to the first authentication information generation algorithm set on the user-side device can also be set, and second authentication information is generated according to the second authentication information generation algorithm, and the first authentication is determined Whether the information matches the second authentication information, if yes, the authentication is passed; otherwise, the authentication fails.

In other examples of this embodiment, the corresponding authentication key can be directly pre-configured as the authentication information on the user-side device and the access device. For different user-side devices, the same authentication key can be configured, or it can be configured Different authentication keys; when the access device receives the protocol access message sent by the user-side device, it can directly extract the authentication key from the protocol access message and match it with the corresponding authentication key on the local side, such as If the match is successful, the authentication is passed; otherwise, the authentication fails. And it should be understood that the authentication key in this embodiment can also be flexibly set, as long as the purpose of security authentication can be achieved. In this example, the security authentication of the protocol access message according to the information to be authenticated is shown in Figure 2, including:

S201: Obtain authentication information pre-configured for the user-side device.

S202: Determine whether the to-be-authenticated information extracted from the protocol access message matches the authentication information pre-configured for the user-side device.

In other examples of this embodiment, in order to further enhance the flexibility and reliability of security authentication, at least two security authentication methods can be set to perform flexible configuration of security authentication methods for each user-side device. During authentication, the security authentication method can be matched first, and only when the security authentication method matches, the subsequent security authentication can be continued, and multi-level and multiple authentication methods can be used for security authentication. In this example, the authentication information includes the safety authentication method, and the safety authentication at this time includes the safety authentication method process shown in Figure 3:

S301: Acquire the security authentication mode in the authentication information pre-configured for the user-side device.

S302: Determine whether the security authentication method in the information to be authenticated extracted from the protocol access message matches the authentication method in the authentication information pre-configured for the user-side device. Only when the safety authentication mode matches, the subsequent safety authentication process is carried out.

In this example, in addition to the safety authentication method, the safety authentication information can also include the authentication content corresponding to each safety authentication method, and in some application scenarios, different safety authentication methods can correspond to different safety authentication levels, so Set the corresponding security authentication method (that is, set the corresponding security authentication level) for the corresponding user-side device according to the corresponding security level setting rules, and when authenticating the protocol access message sent by the user-side device, it is as shown in Figure 3 After the safety authentication method is matched, the authentication content corresponding to the safety authentication method is authenticated. The authentication process is shown in Figure 4, including:

S401: Obtain the authentication content corresponding to the safety authentication mode in the authentication information pre-configured for the user-side device.

S402: Determine the to-be-authenticated content corresponding to the security-to-be-authenticated mode in the to-be-authenticated information extracted from the protocol access message.

S403: Determine whether the content to be authenticated matches the authentication content pre-configured for the user-side device.

It should be understood that in some application scenarios of this embodiment, the execution sequence of the matching process of the authentication method shown in FIG. 3 and the matching process of the authentication content shown in FIG. The authentication process shown in Figure 3, the authentication process shown in Figure 4 is executed when the authentication is passed; the authentication process shown in Figure 4 can also be executed first, and the authentication process shown in Figure 3 is executed when the authentication is passed, or the authentication process shown in Figure 3 and Figures 3 and The authentication process in 4 can also be executed in parallel; the authentication is determined to be successful only when the authentication process shown in Fig. 3 and Fig. 4 are both passed.

It should be understood that, in this embodiment, the authentication method pre-configured for the user-side device and the authentication content corresponding to the authentication method can be, but not limited to, any one of the following Table 1 and is configured for the user-side device , The access device can be configured by issuing corresponding configuration instructions to the user-side device, and the configuration can also be completed by sending the corresponding configuration information to the access device and the user-side device simultaneously by other devices, or by the corresponding configuration personnel Complete the configuration; when the access device sends corresponding configuration instructions to the user side device for configuration, the access device can be configured during the registration process for the user side device, or it can be flexibly configured for the user side device in other time periods.

Table 1

It should be understood that the identification information of the user-side device in Table 1 above may include various identification information that can characterize the identity of the user-side device. For example, the identification information of the user-side device may include, but is not limited to, the SN (Serial Number, product serial number) and at least one of the MAC (Media Access Control, media access control) of the user-side device. The identification information of the access device in the foregoing Table 1 may also include various identification information that can characterize the identity of the access device. For example, the identification information of the access device may include, but is not limited to, the MAC address of the access device.

In the foregoing Table 1, the network slice identification information to which the user-side device belongs may also include various information capable of identifying network slices, such as, but not limited to, network slice numbers.

In Table 1 above, the method of generating the pass key allocated by the access device to the user-side device can be flexibly set, and different user-side devices can be allocated the same pass key or different pass keys. It can be flexibly set according to needs.

In addition, it should be understood that the seven authentication methods illustrated in Table 1 in this embodiment can be flexibly selected. For example, they can be selected flexibly according to the current specific networking environment, the specific type of user-side equipment and other factors, and the selection can be Select some of the authentication methods in Table 1. For example, in some application scenarios, authentication method 1 to authentication method 6 in Table 1 above can be used for configuration; in other application scenarios, authentication method 1 to authentication method 3 in Table 1 above can be used for configuration.

In some examples of this embodiment, when the protocol access message carries virtual local area network VLAN (Virtual Local Area Network, virtual local area network) information, after receiving the protocol access message, the access device can still perform security authentication on it. include:

Determine whether the virtual local area network VLAN carried in the protocol access message belongs to the management VLAN of the NAT function. If so, the protocol access message is authenticated safely; otherwise, the protocol access message is determined to be an illegal protocol access message. VLAN authentication can further improve the flexibility and security of security authentication, which can further save the software and hardware entry resources of the access equipment, and improve the security of the access equipment and the central office equipment.

Correspondingly, the process of sending a protocol access message to the access device on the user side device is shown in Figure 5, including:

S501: Generate a protocol access message, the generated protocol access message includes information to be authenticated, and the method for obtaining the information to be authenticated is shown in the above analysis, and will not be repeated here.

S502: Send the generated protocol access message to the access device supporting the NAT function.

Through the NAT security control method provided in this embodiment, it can be ensured that only user-side devices that have passed the security authentication (that is, have a legal identity) can access the central office device, and that private network users who are not authorized (that is, those who have not passed the authentication) can access the central office device. The inability to access the central office equipment not only ensures that the software and hardware entry resources of the access equipment are saved, but also ensures the security of the central office equipment.

Embodiment two:

This embodiment provides a NAT security control device, which can be installed in various access devices that support the NAT function. As shown in FIG. 6, the NAT security control device includes:

The message receiving module 601 is configured to receive a protocol access message carrying information to be authenticated sent by a user-side device;

The NAT security control module 602 is configured to perform security authentication on the protocol access message according to the information to be authenticated in the received protocol access message, and perform NAT processing on the protocol access message when the security authentication is passed. For the specific authentication control process, please refer to the above-mentioned embodiment, which will not be repeated here.

It should be understood that the functions of the message receiving module 601 and the NAT security control module 602 described above can be implemented by, but not limited to, the first processor of the access device where the NAT security control apparatus is located.

This embodiment provides an access control device, which can be installed in various user-side devices. As shown in FIG. 7, the access control device includes:

The message generating module 701 is configured to generate a protocol access message, and the protocol access message includes information to be authenticated; for the specific generation process, please refer to the above-mentioned embodiment, which will not be repeated here.

The message sending module 702 is configured to send the protocol access message generated by the message generating module 701 to the access device supporting the NAT function.

It should be understood that the functions of the message generating module 701 and the message sending module 702 described above can be implemented by, but not limited to, the second processor of the user-side device where the access control apparatus is located.

For ease of understanding, this embodiment is described below with a specific networking example. In this networking example, the Layer 2 access device is OLT (supporting network slicing), and the user-side device ONU is connected to the PON (Passive Optical Network) port of the OLT, and the uplink port of the OLT device is connected to the public Network; in this networking example:

Plan the authentication methods supported by the access equipment OLT: authentication method 1 with the user-side equipment product serial number SN, MAC address and access equipment MAC address as the core; use the user-side equipment configurable change item management IP address and network slice number as Core authentication method 2; authentication method 3 based on the pass key assigned by the access device; authentication method 1 combined with authentication method 2 to form two-factor authentication method 4, authentication method 1 and authentication method 3 to form two-factor authentication method 5. Combine authentication method 2 with authentication method 3 to form two-factor authentication method 6;

Authentication method pre-configuration: the access device OLT can receive instructions from the networking environment to determine the authentication method of the user-side device; the access device OLT can configure the authentication method of the user-side device through commands, and the access device OLT can simultaneously Synchronize the authentication method and authentication content to the corresponding user-side device in real time. At the same time, the access device OLT updates the authentication database maintained on the local side, and the authentication database contains the authentication method and authentication content of each user-side device;

When the user-side device initiates a connection, a protocol control message (an example of a protocol access message) is packaged to the main control CPU of the access device OLT for processing. The NAT service analyzes the content of the protocol message and finds out the TCP field of the message. Options item, parse out the authentication method and authentication content carried in the message, and perform authentication. The protocol control message that fails the authentication is discarded; the protocol control message that passes the authentication is generated software and hardware forwarding entries to ensure normal operation NAT translation.

In this embodiment, a specific networking mode of the access device OLT (supporting network slicing) is described below. Refer to Figure 8. In this example, the FTP protocol among multiple control protocols is used as an example for description.

In this example, the PON port of the GPON line card registers ONU terminal equipment, and the MAC address of the ONU is set to 74-85-7e-af-66-54, and the SN serial number is 09C62BD. The PON port is divided into network slice 1. The network slice number of the ONU belongs to its registered PON port, so the network slice number of the ONU is 1; the MAC address of the access device OLT is 00-d0-d0-02-06-02 .

The necessary configuration items for deploying the NAT function: first configure the remote management IP address of the ONU as 172.1.1.10; secondly, create the L3 VLAN interface vlan100, and use this VLAN 100 as the management VLAN for the NAT function; finally configure the IP address of the vlan100 interface as 172.1 .1.1, both IP addresses belong to the same network segment.

Plan 6 authentication methods for access devices: authentication method 1 with the user-side device product serial number SN, MAC address, and access device MAC address as the core, and the user-side device variable configuration item management IP address and network slice number as the core Core authentication method 2, authentication method 3 based on the pass assigned by the access device, two-factor authentication method 4 (authentication method 1 & authentication method 2), two-factor authentication method 5 (authentication method 1 & authentication method 3), two-factor authentication method Authentication method 6 (Authentication method 2&Authentication method 3);

The authentication method is assigned to the user-side device, whether to perform authentication and the authentication level can be determined by the access device OLT. This item is a configurable item, and the access device OLT can be determined according to the complexity of the actual networking environment (for example, it can be determined according to the instructions issued by the configurator). After that, the access device OLT notifies the user-side device of the authentication method and authentication content, and the user-side device parses and stores it locally. The access device OLT also updates the locally maintained authentication database. The authentication database can be authenticated as multiple entries of the index. In this example, six authentication methods are used, and six database entries can be set, one corresponding to one authentication method.

Application scenario one:

Assuming that the user-side device ONU is pre-configured with authentication method 1, the access device OLT informs the user-side device of authentication method 1 and the corresponding authentication content, so that when the user-side device initiates an FTP connection, the first option in the TCP field of the FTP packet 4-byte encapsulation authentication method 1, 2~4, the 3 4-bytes encapsulate the MAC address of the user-side device and the MAC address of the next hop, and the 2 4-bytes 5--6 encapsulate the serial number SN of the user-side device . The access device OLT updates the authentication method 1 database entries maintained on the local side. An example is shown in Table 2 below. When the user-side device initiates an FTP connection, it will generate a TCP connection SYN (Synchronize Sequence Numbers) message. The microcode driver of the access device OLT analyzes the VLAN carried in the SYN message as 100, and VLAN 100 is the network. In the management VLAN of slice 1, the message is delivered to the main control CPU of the access device OLT; the NAT service of the access device OLT analyzes the protocol message to find out the authentication method and authentication content filled in the options of the TCP field. Confirm that the authentication method 1 carried is consistent with the specified authentication method 1. By searching the database, it is found that the encapsulated MAC address 74-85-7e-af-66-54, the product serial number 09C62BD exists in the database entry, and the next hop The MAC address is the access device. The protocol message is authenticated, and the FTP control message is translated through NAT. A configuration table entry and two forwarding entries will be generated. One of the forwarding entries is a software forwarding entry, and the other is a software forwarding entry. It is a hardware forwarding entry. The software entry is used for NAT translation of FTP control link messages, and the hardware entry is used for NAT translation of FTP data link messages. After the forwarding entry is established, the communication between the central office device and the user side device The FTP connection is normal;

In this application scenario, the user-side device usually connects to multiple PC devices. Assume that a private network PC has a MAC address of 54-65-85-62-46-00 and an IP address of 172.1.1.20. After an FTP connection is initiated, Generate a TCP connection SYN message. The control message is transparently transmitted by the user-side device and then sent to the main control CPU of the access device for processing. The NAT service analyzes the options in the TCP field and finds that it does not carry the authentication method, or the authentication method carried is inconsistent with the database, then the authentication fails, and it is judged that this is an illegal FTP connection; the packet will be discarded, and no configuration entries and Forwarding the entry, the FTP connection will fail, so the attack of illegal protocol access packets can be avoided.

Table 2

verification method	User-side device MAC address	User side equipment SN
Authentication method 1	74-85-7e-af-66-54	09C62BD
Authentication method 1	74-85-8c-7f-00-69	09C6278
Authentication method 1	74-85-e6-06-98-82	09C65DE
Authentication method 1	74-85-e6-56-08-72	09D5230
...	...	...

Application scenario two:

Assuming that the user-side device ONU is pre-configured with authentication method 2, the access device OLT notifies the user-side device of authentication method 2 so that when the user-side device initiates an FTP connection, the first 4-byte encapsulation authentication of the TCP field options of the control packet Method 2, the second byte encapsulates the network slice number, and the third 4-byte encapsulation management IP address. The access device OLT updates the locally maintained database entries of authentication mode 2, as shown in Table 3 below. After the user-side device ONU normally initiates an FTP connection, the microcode driver of the access device OLT will package the protocol message to the main control CPU of the access device OLT for processing. The NAT service of the access device OLT parses the protocol message, finds the authentication method and authentication content filled in the options of the TCP field, confirms that the authentication method carried is consistent with the authentication method 2 specified by the configuration, and finds it by searching the authentication method 2 database The encapsulated network slice number is 1, and the management IP address 172.1.1.10 exists in the database entry, and the protocol message is authenticated; if the network slice number parsed by the message is 2, even if the management IP address is 172.1.1.10, the message Also authentication failed.

table 3

verification method	Network slice number	Management IP address
Authentication method 2	1	172.1.1.10

Authentication method 2	2	192.168.0.6
Authentication method 2	2	15.1.1.100
Authentication method 2	0	168.5.6.20
...	...	...

Application scenario three:

Assuming that authentication mode 3 is pre-configured for the user-side device ONU, the access device OLT notifies the user-side device of authentication mode 3 and the pass (a set of character strings), so that when the user-side device initiates an FTP connection, the TCP field options of the FTP packet The first 4-byte encapsulation authentication method 3, and then encapsulate the pass. The access device updates the database entries corresponding to authentication mode 3 maintained locally, as shown in Table 4 below. After the user-side device ONU initiates an FTP connection, the microcode driver of the access device OLT will package the protocol message to the main control CPU of the access device OLT for processing. The NAT service of the access device OLT parses the protocol message, finds the authentication method and authentication content filled in the options of the TCP field, confirms that the authentication method carried is consistent with the authentication method 3 specified by the configuration, and finds it by searching the authentication method 3 database The encapsulated passport is consistent with the "Hello World" in the database, and the protocol message is authenticated. If the pass is "What’s your name" and there is no such key in the database, then the message authentication fails.

Table 4

verification method	Pass key
Authentication method 3	Hello World
Authentication method 3	This is Chain
Authentication method 3	Today is Sunday
Authentication method 3	It is a sunny day
...	...

Application scenario four:

Assuming that the user-side device ONU is pre-configured with authentication mode 6, the access device OLT notifies the user-side device of authentication mode 6 so that when the user-side device initiates an FTP connection, the first 4-byte encapsulation authentication of the TCP field options of the FTP message Method 6, the second 4-byte encapsulation network slice number, the third 4-byte encapsulation management IP address, and the following bytes encapsulate the pass. The access device OLT updates the database entries corresponding to authentication mode 6 maintained locally, as shown in Table 5. When the user-side device ONU initiates an FTP connection, the microcode driver of the access device OLT will package the protocol message to the main control CPU of the access device OLT for processing; the NAT service of the access device OLT parses the protocol message and finds out the TCP The authentication method and authentication content filled in the options of the field confirm that the authentication method carried is consistent with the authentication method 6 specified in the configuration. By searching the authentication method 6 database, it is found that the encapsulated network slice number is 1, and the management IP address is 172.1.1.10. The pass is "Hello World", which is consistent with the first record in the database, and the protocol message is authenticated. If the pass is "What’s your name", or the network slice number is not 1, or the network slice number and the pass exist, but the management IP address 10.10.16.23 does not exist, then the message authentication fails.

table 5

verification method	Network slice number	Management IP address	Pass key
Authentication method 6	1	172.1.1.10	Hello World
Authentication method 6	2	192.168.0.6	This is Chain
Authentication method 6	2	15.1.1.100	Today is Sunday
Authentication method 6	0	168.5.6.20	It is a sunny day
...	...	...	...

In the foregoing example scenario of this embodiment, a processing flow of the access device is shown in FIG. 9, including:

S901: The PON port of the access device OLT receives FTP protocol packets.

S902: The line card of the access device OLT receives the packet.

S903: Determine whether the VLAN in the received message is hit, that is, whether it belongs to the management VLAN of the NAT function, if not, go to S904; if yes, go to S905.

S904: Discard the received message.

S905: Submit the message to the main control CPU of the access device OLT.

S906: The main control CPU invokes the NAT service module of the NAT function to perform security authentication.

S907: Whether the safety authentication is passed, if not, go to S904; otherwise, go to S908.

S908: Generate a forwarding entry.

In this embodiment, the differences between the authentication contents of authentication mode 1 to authentication mode 6 are as follows:

Authentication method 1: Authentication MAC address and product serial number SN;

Authentication method 2: Authentication network slice number and management IP address;

Authentication method 3: Authentication communication certificate key;

Authentication method 4: Authentication MAC address, product serial number SN, network slice number and management IP address;

Authentication method 5: authentication MAC address, product serial number SN, communication certificate key;

Authentication method 6: authentication network slice number, management IP address, communication certificate key.

For ease of understanding, this embodiment will be described below by taking an application scenario where no security authentication is set as an example for comparison. In this application scenario, the private network user artificially sets the PC's IP address to the management IP address of the user-side device ONU, then after the private network PC initiates the FTP service, the ONU transparently transmits such actions; the same During the period of time, if a private network PC initiates multiple FTP connections through multiple FTP clients, it will occupy a large amount of forwarding entry resources; when the forwarding entry resources are exhausted, the consequence is that the FTP action will continue Occupies a lot of network bandwidth, affects the normal processing of packets, and causes packet loss. More serious, the NAT function of the OLT equipment will fail, and the bureau equipment cannot manage the user-side equipment through the OLT. More serious, private network users can maliciously damage the system files of the central office equipment. The security control method provided by this embodiment can ensure the normal operation of the NAT function of the OLT device, and can also greatly provide the security factor of the access device and the central office device.

Example three:

This embodiment also provides an access device with a NAT function. As shown in FIG. 10, it includes a first processor 1001, a first memory 1002, and a first communication bus 1003;

The first communication bus 1003 is used to implement a communication connection between the first processor 1001 and the first memory 1002;

In an example, the first processor 1001 may be used to execute the first computer program stored in the first memory 1002 to implement the steps of the NAT security control method in the above embodiments.

This embodiment also provides a user-side device. As shown in FIG. 11, it includes a second processor 1001, a second memory 1002, and a second communication bus 1003;

The second communication bus 1003 is used to implement a communication connection between the second processor 1001 and the second memory 1002;

In an example, the second processor 1001 may be used to execute the second computer program stored in the second memory 1002 to implement the steps of the access control method in the above embodiments.

This embodiment also provides a computer-readable storage medium, which is included in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Volatile or non-volatile, removable or non-removable media. Computer-readable storage media include but are not limited to RAM (Random Access Memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, charged Erasable Programmable Read-Only Memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store desired information and that can be accessed by a computer.

In an example, the computer-readable storage medium in this embodiment can be used to store a first computer program, and the first computer program can be executed by the first processor to implement the NAT security control method in the above embodiments. step.

In another example, the computer-readable storage medium in this embodiment can be used to store a second computer program, and the second computer program can be executed by a second processor to implement the access control method in the above embodiments. step.

This embodiment also provides a first computer program (or first computer software). The first computer program may be distributed on a computer-readable medium and executed by a computable device, so as to realize as shown in the above embodiments. At least one step of the NAT security control method; and in some cases, at least one step shown or described can be performed in a different order from that described in the above-mentioned embodiment.

This embodiment also provides a second computer program (or second computer software). The second computer program can be distributed on a computer-readable medium and executed by a computable device to realize the At least one step of the access control method; and in some cases, at least one step shown or described can be performed in a different order from the order described in the above-mentioned embodiment.

This embodiment also provides a computer program product, including a computer readable device, and any computer program as shown above is stored on the computer readable device. The computer-readable device in this embodiment may include the computer-readable storage medium as shown above.

It can be seen that those skilled in the art should understand that all or some of the steps, functional modules/units in the system, and devices in the methods disclosed above can be implemented as software (which can be implemented by computer program code executable by a computing device). ), firmware, hardware and their appropriate combination. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .

In addition, as is well known to those of ordinary skill in the art, communication media usually contain computer-readable instructions, data structures, computer program modules, or other data in a modulated data signal such as carrier waves or other transmission mechanisms, and may include any information delivery medium. Therefore, this application is not limited to any specific combination of hardware and software.

The above content is a further detailed description of the embodiments of the application in combination with specific implementations, and it cannot be considered that the specific implementations of the application are limited to these descriptions. For those of ordinary skill in the technical field to which this application belongs, a number of simple deductions or substitutions can be made without departing from the concept of this application, and they should all be regarded as belonging to the scope of protection of this application.

Claims (13)

1. A network address translation NAT security control method, including:

   Receiving the protocol access message carrying the information to be authenticated sent by the user-side device;

   Performing security authentication on the protocol access message according to the information to be authenticated;

   When the security authentication is passed, NAT processing is performed on the protocol access message.
2. 8. The NAT security control method according to claim 1, wherein said performing security authentication on said protocol access message according to said information to be authenticated comprises:

   Acquiring authentication information pre-configured for the user-side device;

   It is determined whether the information to be authenticated matches the authentication information pre-configured for the user-side device.
3. 3. The NAT security control method according to claim 2, wherein the information to be authenticated includes an authentication method, and the authentication information pre-configured for the user-side device includes an authentication method;

   The determining whether the to-be-authenticated information matches the authentication information pre-configured for the user-side device includes:

   It is determined whether the to-be-authenticated mode matches the authentication mode pre-configured for the user-side device.
4. The NAT security control method according to claim 3, wherein the information to be authenticated further includes content to be authenticated, and the authentication information pre-configured for the user-side device further includes authentication content corresponding to the authentication method ；

   The determining whether the information to be authenticated matches the authentication information pre-configured for the user-side device further includes:

   It is determined whether the content to be authenticated matches the authentication content pre-configured for the user-side device.
5. The NAT security control method according to claim 4, wherein the authentication method pre-configured for the user-side device and the authentication content corresponding to the authentication method are any one of the following:

   Authentication method 1: Perform authentication based on the identification information of the user-side device and the identification information of the access device;

   The second authentication method is to perform authentication based on the management IP address of the user-side device and the identification information of the network slice to which the user-side device belongs;

   The third authentication method is to perform authentication according to the pass key assigned by the access device to the user-side device;

   Authentication method 4: Perform authentication based on the identification information of the user-side device, the identification information of the access device, the management IP address of the user-side device, and the identification information of the network slice to which the user-side device belongs;

   The fifth authentication method is to perform authentication based on the identification information of the user-side device, the identification information of the access device, and the pass key assigned by the access device to the user-side device;

   Authentication method six, authentication is performed according to the management IP address of the user-side device, the network slice identification information to which the user-side device belongs, and the pass key assigned by the access device to the user-side device;

   Authentication method seven, based on the identification information of the user-side device, the identification information of the access device, the management IP address of the user-side device, the network slice identification information to which the user-side device belongs, and the pass key assigned by the access device to the user-side device Certification.
6. 5. The NAT security control method according to claim 5, wherein the identification information of the user-side device includes: at least one of the product serial number SN of the user-side device and the media access control MAC address of the user-side device;

   The identification information of the access device includes the MAC address of the access device.
7. 7. The NAT security control method according to any one of claims 1 to 6, wherein before said performing security authentication on the protocol access message, the method further comprises:

   Only when it is determined that the virtual local area network VLAN carried in the protocol access message belongs to the management VLAN of the NAT function, the security authentication is performed on the protocol access message.
8. An access control method, including:

   Generating a protocol access message, the protocol access message including information to be authenticated;

   The protocol access message is sent to the access device supporting the NAT function.
9. A NAT security control device, including:

   The message receiving module is used to receive the protocol access message carrying the information to be authenticated sent by the user side device;

   The NAT security control module is configured to perform security authentication on the protocol access message according to the information to be authenticated, and perform NAT processing on the protocol access message when the security authentication is passed.
10. An access control device includes:

    A message generating module, configured to generate a protocol access message, the protocol access message including information to be authenticated;

    The message sending module is used to send the protocol access message to the access device supporting the NAT function.
11. An access device, wherein the access device supports a NAT function, and includes a first processor, a first memory, and a first communication bus;

    The first communication bus is used to connect the first processor and the first memory;

    The first processor is configured to execute the first computer program stored in the first memory to implement the steps of the NAT security control method according to any one of claims 1-7.
12. A user-side device includes a second processor, a second memory, and a second communication bus;

    The second communication bus is used to connect the second processor and the second memory;

    The second processor is configured to execute a second computer program stored in the second memory to implement the steps of the access control method according to claim 8.
13. A computer-readable storage medium, wherein a first computer program is stored in the computer-readable storage medium, and the first computer program can be executed by a first processor to implement any one of claims 1-7. The steps of the NAT security control method described;

    Or, the computer-readable storage medium stores a second computer program, and the second computer program can be executed by the second processor to implement the steps of the access control method according to claim 8.

Images