CN103888435A - Service admission control method, device and system - Google Patents
Service admission control method, device and system Download PDFInfo
- Publication number
- CN103888435A CN103888435A CN201210566946.5A CN201210566946A CN103888435A CN 103888435 A CN103888435 A CN 103888435A CN 201210566946 A CN201210566946 A CN 201210566946A CN 103888435 A CN103888435 A CN 103888435A
- Authority
- CN
- China
- Prior art keywords
- surplus resources
- information
- network access
- access server
- authentication response
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention discloses a service admission control method, device and system. The service admission control method comprises the steps that an authentication request sent by a network access server is received; through user account information, the first resource demand related to an access service is acquired; a remaining resource list is used to query remaining resource; if the remaining resource is greater than the first resource demand, the first resource demand is subtracted from the remaining resource, so as to update the remaining resource list; and authentication response information is sent to the network access server, wherein the authentication response information comprises a service admission instruction. The attribute information in a Radius protocol is used to determine common bottleneck points in a network. By judging whether the remaining resource in the network can meet the need of a new online application service, service admission control is realized, and the user experience is improved.
Description
Technical field
The present invention relates to the communications field, particularly a kind of methods, devices and systems for business admission control.
Background technology
Operator is often by QoS(Quality of Service, service quality) mechanism and admission control scheme realize the quality assurance to specific high value business, adopts at present two kinds of control methods:
1, static cost control: be in fact business underloading strategy, according to the topological sum trunk bandwidth of broadband access network, specify that each access network equipment/repeated link can only develop certain class service-user of respective numbers.
2, dynamically control: dynamic evaluation resource situation, receive/refuse user's request or point out possible result, the preferential guarantee customer service quality using of having reached the standard grade.
Wherein no matter dynamic control mode all preponderates obviously at the aspect such as operation management, the utilization of resources, is also the direction of future development.
In recent years some solutions of industry can reach the effect of dynamic accommodation control, but these schemes need the extra equipment of network deploy, and initial and follow-up dilatation drops into huge, and has increased network failure point and O&M risk.
Summary of the invention
The technical problem to be solved in the present invention is to provide a kind of methods, devices and systems for business admission control.By utilizing Radius(Remote Authentication Dial In User Service, remote customer dialing authentication) attribute information in agreement determines bottleneck point common in network, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
According to an aspect of the present invention, provide a kind of method for business admission control, comprising:
Receive the authentication request that network access server sends, wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server;
Obtain the first resource demand being associated with access service by usersaccount information;
Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID;
Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand;
If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server;
If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction, so that network access server refusal accessing user terminal to network access server.
According to a further aspect in the invention, provide a kind of method for business admission control, comprising:
Receive the access request that user terminal sends, wherein access request comprises usersaccount information;
Send authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction;
Receive the authentication response information that Radius certificate server sends;
Judge and in authentication response information, whether comprise business admission instruction;
If authentication response information comprises business admission instruction, allow accessing user terminal to network access server;
If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server.
According to a further aspect in the invention, provide a kind of Radius certificate server for business admission control, comprising:
The first receiving element, the authentication request sending for receiving network access server, wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server;
The first extraction unit, for obtaining the first resource demand being associated with access service by usersaccount information;
Query unit, be used for utilizing surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID;
The first recognition unit, for judging whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, instruction the first transmitting element sends authentication response information to network access server, and wherein authentication response information comprises service denial instruction;
Updating block, be used for according to the judged result of the first recognition unit, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, and indicate the first transmitting element to send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server;
The first transmitting element, for according to the instruction of updating block, sends authentication response information to network access server, and wherein authentication response information comprises business admission instruction; According to the instruction of the first recognition unit, send authentication response information to network access server, wherein authentication response information comprises service denial instruction, so that network access server refusal accessing user terminal to network access server.
According to a further aspect in the invention, provide a kind of network access server for business admission control, comprising:
The second receiving element, the access request sending for receiving user terminal, wherein access request comprises usersaccount information, receives the authentication response information that Radius certificate server sends;
The second transmitting element, for sending authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction;
The 3rd recognition unit, for judging whether authentication response information comprises business admission instruction;
Access control unit, for according to the judged result of the 3rd recognition unit, if authentication response information comprises business admission instruction, allows accessing user terminal to network access server; If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server.
According to a further aspect in the invention, provide a kind of system for business admission control, comprising:
Network access server, the access request sending for receiving user terminal, wherein access request comprises usersaccount information, send authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; Receive the authentication response information that Radius certificate server sends, judge and in authentication response information, whether comprise that business admission indicates; If authentication response information comprises business admission instruction, allow accessing user terminal to network access server; If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server;
Radius certificate server, the authentication request sending for receiving network access server, obtain the first resource demand being associated with access service by usersaccount information, utilize surplus resources list, inquiry and network access server IP address information, groove position information, pilot trench information, remaining the first surplus resources of network access server port that port information is corresponding, remaining the second surplus resources of the particular virtual local area network corresponding with the first VLAN ID, remaining the 3rd surplus resources of the user VLAN corresponding with the second VLAN ID, judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction, if the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction,
The present invention, by utilizing the attribute information in Radius agreement to determine bottleneck point common in network, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realizes business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Brief description of the drawings
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, to the accompanying drawing of required use in embodiment or description of the Prior Art be briefly described below, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, do not paying under the prerequisite of creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is the schematic diagram of an embodiment of service admission control method of the present invention.
Fig. 2 is the schematic diagram of another embodiment of service admission control method of the present invention.
Fig. 3 is the schematic diagram of an embodiment of Radius certificate server of the present invention.
Fig. 4 is the schematic diagram of another embodiment of Radius certificate server of the present invention.
Fig. 5 is the schematic diagram of an embodiment of network access server of the present invention.
Fig. 6 is the schematic diagram of another embodiment of network access server of the present invention.
Fig. 7 is the schematic diagram of an embodiment of business admission control system of the present invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is clearly and completely described, obviously, described embodiment is only the present invention's part embodiment, instead of whole embodiment.Illustrative to the description only actually of at least one exemplary embodiment below, never as any restriction to the present invention and application or use.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtaining under creative work prerequisite, belong to the scope of protection of the invention.
Unless illustrate in addition, otherwise the parts of setting forth in these embodiments and positioned opposite, numeral expression formula and the numerical value of step not limited the scope of the invention.
, it should be understood that for convenience of description, the size of the various piece shown in accompanying drawing is not to draw according to actual proportionate relationship meanwhile.
May not discuss in detail for the known technology of person of ordinary skill in the relevant, method and apparatus, but in suitable situation, described technology, method and apparatus should be regarded as authorizing a part for specification.
In all examples with discussing shown here, it is exemplary that any occurrence should be construed as merely, instead of as restriction.Therefore, other example of exemplary embodiment can have different values.
It should be noted that: in similar label and letter accompanying drawing below, represent similar terms, therefore, once be defined in an a certain Xiang Yi accompanying drawing, in accompanying drawing subsequently, do not need it to be further discussed.
Fig. 1 is the schematic diagram of an embodiment of service admission control method of the present invention.Preferably, the method step of this embodiment can be carried out by Radius certificate server.
Step 101, receives the authentication request that network access server sends.
Wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server.
Step 102, obtains the first resource demand being associated with access service by usersaccount information.
Step 103, utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID.
Step 104, judges whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand.
Step 105, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server.
Step 106, if the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction, so that network access server refusal accessing user terminal to network access server.
The service admission control method providing based on the above embodiment of the present invention, determine bottleneck point common in network by utilizing the attribute information in Radius agreement, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Owing to carrying the mark joining with traffic aided in user account number, therefore can understand type and the required bandwidth of related service by identifying this mark.For example, by the correlated identities in user account number, can understand this business is high definition business, is 2M thereby determine the needed bandwidth of high definition business.
Preferably, NAS-IP-Address attribute information and NAS-Port-ID attribute information are as follows:
NAS-IP-Address NAS_IP=“x.x.x.x"
NAS-Port-ID NAS_PORT_ID="slot=1;subslot=2;port=3;vlanid1=x;vlanid2=y;"
Wherein NAS_IP, slot, these 4 correspondences of subslot, port the BRAS port of user access, the corresponding PVLAN(Private VLAN of vlanid1, particular virtual local area network), the corresponding CVLAN(customer VLAN of vlanid2, user's VLAN), so obtain can accurately locate each business reach the standard grade through 3 bottleneck point information.
Preferably, in the time that the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, can also send notice to user terminal by network access server, available resources situation is sent to user, user can select to abandon this time to receive request, and the mode that also can select to reduce QoS continues access operation.
Preferably, after the step of the authentication request sending at above-mentioned reception network access server, also comprise:
Utilize predetermined binding contingency table, judge whether usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information;
If usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information, carry out the step of obtaining the first resource demand being associated with access service by usersaccount information.
Because user account number can only access by pre-assigned circuit and port, therefore except the legitimacy of user account number itself is authenticated, can also authenticate the incidence relation of user account number and NAS-IP-Address attribute information and NAS-Port-ID attribute information, thus the legitimacy of further authentication of users account number.
Preferably, roll off the production line when notice when receiving the business that network access server sends, utilize business to roll off the production line usersaccount information that notice comprises obtains the Secondary resource demand with the traffic aided connection that rolls off the production line.
Respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are increased to described Secondary resource demand, thereby upgrade surplus resources list.
Thereby, in the time that customer service rolls off the production line, by the surplus resources list that upgrades in time, to provide resource judgment accurately for other service access.
Fig. 2 is the schematic diagram of another embodiment of service admission control method of the present invention.Preferably, the method step of this embodiment can be carried out by network access server.
Wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction.
The service admission control method providing based on the above embodiment of the present invention, determine bottleneck point common in network by utilizing the attribute information in Radius agreement, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Preferably, in the time detecting that user terminal rolls off the production line, to the Radius certificate server transmission business notice that rolls off the production line, wherein business rolls off the production line to notify and comprises usersaccount information, the usersaccount information that notice comprises so that the business of utilizing Radius certificate server rolls off the production line obtains the Secondary resource demand with the traffic aided connection that rolls off the production line, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are increased to described Secondary resource demand, thereby upgrade surplus resources list.
Thereby, can be according to the online situation of business, surplus resources list upgrades in time.
Fig. 3 is the schematic diagram of an embodiment of Radius certificate server of the present invention.As shown in Figure 3, Radius certificate server comprises:
The first receiving element 301, the authentication request sending for receiving network access server, wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server.
The first extraction unit 302, for obtaining the first resource demand being associated with access service by usersaccount information.
The first recognition unit 304, for judging whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, instruction the first transmitting element 306 sends authentication response information to network access server, and wherein authentication response information comprises service denial instruction.
Updating block 305, be used for according to the judged result of the first recognition unit 304, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, and indicate the first transmitting element 306 to send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server.
The first transmitting element 306, for according to the instruction of updating block 305, sends authentication response information to network access server, and wherein authentication response information comprises business admission instruction; According to the instruction of the first recognition unit 304, send authentication response information to network access server, wherein authentication response information comprises service denial instruction; So that network access server refusal accessing user terminal to network access server.
The Radius certificate server providing based on the above embodiment of the present invention, determine bottleneck point common in network by utilizing the attribute information in Radius agreement, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Fig. 4 is the schematic diagram of another embodiment of Radius certificate server of the present invention.Compared with embodiment illustrated in fig. 3, in the embodiment shown in fig. 4, Radius certificate server also comprises the second recognition unit 401, for receiving at the first receiving element 301 after the authentication request of network access server transmission, utilize predetermined binding contingency table, judge whether usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information; If usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information, indicate the first extraction unit 302 to carry out the operation of obtaining the first resource demand being associated with access service by usersaccount information.
Preferably, described Radius certificate server also comprises the second extraction unit 402, when roll off the production line notice for receive the business of network access server transmission when the first receiving element 301, utilize business to roll off the production line and notify the usersaccount information comprising to obtain the Secondary resource demand joining with the traffic aided that rolls off the production line; Then indicate updating block 305 respectively the first surplus resources, the second surplus resources and the 3rd surplus resources to be increased to described Secondary resource demand, thereby upgrade surplus resources list.
Fig. 5 is the schematic diagram of an embodiment of network access server of the present invention.As shown in Figure 5, network access server comprises:
The second receiving element 501, the access request sending for receiving user terminal, wherein access request comprises usersaccount information, receives the authentication response information that Radius certificate server sends.
The second transmitting element 502, for sending authentication request to Radius certificate server.
Wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction.
The 3rd recognition unit 503, for judging whether authentication response information comprises business admission instruction.
The network access server providing based on the above embodiment of the present invention, utilize the attribute information in Radius agreement to determine bottleneck point common in network by Radius certificate server, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Fig. 6 is the schematic diagram of another embodiment of network access server of the present invention.Compared with embodiment illustrated in fig. 5, in the embodiment shown in fig. 6, network access server also comprises detecting unit 601, for detection of the presence of user terminal, in the time detecting that user terminal rolls off the production line, indicate the second transmitting element 502 to the Radius certificate server transmission business notice that rolls off the production line, wherein business rolls off the production line to notify and comprises usersaccount information, the usersaccount information that notice comprises so that the business of utilizing Radius certificate server rolls off the production line obtains the Secondary resource demand with the traffic aided connection that rolls off the production line, respectively by the first surplus resources, the second surplus resources and the 3rd surplus resources increase described Secondary resource demand, thereby upgrade surplus resources list.
Fig. 7 is the schematic diagram of an embodiment of business admission control system of the present invention.As shown in Figure 7, described system comprises network access server 701 and Radius certificate server 702.Wherein:
The system providing based on the above embodiment of the present invention, determine bottleneck point common in network by utilizing the attribute information in Radius agreement, by judging whether the surplus resources in network can meet the needs of line service in new application, thereby realize business admission control.Owing to can not increasing new equipment, therefore can not increase network failure point, thereby simple, fast, save, realized business admission efficiently and dynamically control, promoted user's experience.
Preferably, Radius certificate server is the Radius certificate server that in Fig. 3 or Fig. 4, arbitrary embodiment relates to, and network access server is the network access server that in Fig. 5 or Fig. 6, arbitrary embodiment relates to.
Compared with existing Radius workflow, only need in database, increase the tables of data of the real-time resource money of maintaining network bottleneck point situation, and increase the Rule of judgment that an access allows and can realize.It makes full use of existing device and carries out suitable optimization and software improvement, without newly added equipment, can not increase network failure point, thereby dynamic accommodation control simple, quick, that save, efficiently realized high value business has promoted user/business experience.
The present invention dynamically adjusts timer duration by the state that utilizes user terminal, network, thereby utilizes substantially network performance, does not also affect user simultaneously and experiences and connect duration statistical accuracy, has improved the dynamic and intelligent control that user network connects.
One of ordinary skill in the art will appreciate that all or part of step that realizes above-described embodiment can complete by hardware, also can carry out the hardware that instruction is relevant by program completes, described program can be stored in a kind of computer-readable recording medium, the above-mentioned storage medium of mentioning can be read-only memory, disk or CD etc.
Description of the invention provides for example with for the purpose of describing, and is not exhaustively or limit the invention to disclosed form.Many modifications and variations are obvious for the ordinary skill in the art.Selecting and describing embodiment is for better explanation principle of the present invention and practical application, thereby and makes those of ordinary skill in the art can understand the present invention's design to be suitable for the various embodiment with various amendments of special-purpose.
Claims (12)
1. for a method for business admission control, it is characterized in that, comprising:
Receive the authentication request that network access server sends, wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server;
Obtain the first resource demand being associated with access service by usersaccount information;
Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID;
Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand;
If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server;
If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction, so that network access server refusal accessing user terminal to network access server.
2. method according to claim 1, is characterized in that:
After receiving the step of authentication request of network access server transmission, also comprise:
Utilize predetermined binding contingency table, judge whether usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information;
If usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information, carry out the step of obtaining the first resource demand being associated with access service by usersaccount information.
3. method according to claim 1 and 2, is characterized in that:
Roll off the production line when notice when receiving the business that network access server sends, utilize business to roll off the production line usersaccount information that notice comprises obtains the Secondary resource demand with the traffic aided connection that rolls off the production line;
Respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are increased to described Secondary resource demand, thereby upgrade surplus resources list.
4. for a method for business admission control, it is characterized in that, comprising:
Receive the access request that user terminal sends, wherein access request comprises usersaccount information;
Send authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction;
Receive the authentication response information that Radius certificate server sends;
Judge and in authentication response information, whether comprise business admission instruction;
If authentication response information comprises business admission instruction, allow accessing user terminal to network access server;
If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server.
5. method according to claim 4, is characterized in that:
In the time detecting that user terminal rolls off the production line, to the Radius certificate server transmission business notice that rolls off the production line, wherein business rolls off the production line to notify and comprises usersaccount information, the usersaccount information that notice comprises so that the business of utilizing Radius certificate server rolls off the production line obtains the Secondary resource demand with the traffic aided connection that rolls off the production line, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are increased to described Secondary resource demand, thereby upgrade surplus resources list.
6. for a Radius certificate server for business admission control, it is characterized in that, comprising:
The first receiving element, the authentication request sending for receiving network access server, wherein access server sends authentication request in the time receiving the access request of user terminal transmission, authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server;
The first extraction unit, for obtaining the first resource demand being associated with access service by usersaccount information;
Query unit, be used for utilizing surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID;
The first recognition unit, for judging whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, instruction the first transmitting element sends authentication response information to network access server, and wherein authentication response information comprises service denial instruction;
Updating block, be used for according to the judged result of the first recognition unit, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, and indicate the first transmitting element to send authentication response information to network access server, wherein authentication response information comprises business admission instruction, so that network access server allows accessing user terminal to network access server;
The first transmitting element, for according to the instruction of updating block, sends authentication response information to network access server, and wherein authentication response information comprises business admission instruction; According to the instruction of the first recognition unit, send authentication response information to network access server, wherein authentication response information comprises service denial instruction; So that network access server refusal accessing user terminal to network access server.
7. Radius certificate server according to claim 6, it is characterized in that, Radius certificate server also comprises the second recognition unit, for receiving at the first receiving element after the authentication request of network access server transmission, utilize predetermined binding contingency table, judge whether usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information; If usersaccount information is associated with NAS-IP-Address attribute information and NAS-Port-ID attribute information, indicate the first extraction unit to carry out the operation of obtaining the first resource demand being associated with access service by usersaccount information.
8. according to the Radius certificate server described in claim 6 or 7, it is characterized in that, described Radius certificate server also comprises the second extraction unit, when roll off the production line notice for receive the business of network access server transmission when the first receiving element, utilize business to roll off the production line and notify the usersaccount information comprising to obtain the Secondary resource demand joining with the traffic aided that rolls off the production line; Then indicate updating block respectively the first surplus resources, the second surplus resources and the 3rd surplus resources to be increased to described Secondary resource demand, thereby upgrade surplus resources list.
9. for a network access server for business admission control, it is characterized in that, comprising:
The second receiving element, the access request sending for receiving user terminal, wherein access request comprises usersaccount information, receives the authentication response information that Radius certificate server sends;
The second transmitting element, for sending authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; So that Radius certificate server obtains the first resource demand being associated with access service by usersaccount information; Utilize surplus resources list, inquiry network access server port remaining first surplus resources corresponding with network access server IP address information, groove position information, pilot trench information, port information, with corresponding remaining the second surplus resources of particular virtual local area network of the first VLAN ID, and corresponding remaining the 3rd surplus resources of user's VLAN of the second VLAN ID; Judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand; If the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction; If the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction;
The 3rd recognition unit, for judging whether authentication response information comprises business admission instruction;
Access control unit, for according to the judged result of the 3rd recognition unit, if authentication response information comprises business admission instruction, allows accessing user terminal to network access server; If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server.
10. network access server according to claim 9, it is characterized in that, network access server also comprises detecting unit, for detection of the presence of user terminal, in the time detecting that user terminal rolls off the production line, indicate the second transmitting element to the Radius certificate server transmission business notice that rolls off the production line, wherein business rolls off the production line to notify and comprises usersaccount information, the usersaccount information that notice comprises so that the business of utilizing Radius certificate server rolls off the production line obtains the Secondary resource demand with the traffic aided connection that rolls off the production line, respectively by the first surplus resources, the second surplus resources and the 3rd surplus resources increase described Secondary resource demand, thereby upgrade surplus resources list.
11. 1 kinds of systems for business admission control, is characterized in that, comprising:
Network access server, the access request sending for receiving user terminal, wherein access request comprises usersaccount information, send authentication request to Radius certificate server, wherein authentication request comprises usersaccount information, NAS-IP-Address attribute information and NAS-Port-ID attribute information, NAS-IP-Address attribute information comprises network access server IP address information, and NAS-Port-ID attribute information comprises groove position information, pilot trench information, port information, the first VLAN ID and second VLAN ID of network access server; Receive the authentication response information that Radius certificate server sends, judge and in authentication response information, whether comprise that business admission indicates; If authentication response information comprises business admission instruction, allow accessing user terminal to network access server; If authentication response information comprises service denial instruction, refusal accessing user terminal to network access server;
Radius certificate server, the authentication request sending for receiving network access server, obtain the first resource demand being associated with access service by usersaccount information, utilize surplus resources list, inquiry and network access server IP address information, groove position information, pilot trench information, remaining the first surplus resources of network access server port that port information is corresponding, remaining the second surplus resources of the particular virtual local area network corresponding with the first VLAN ID, remaining the 3rd surplus resources of the user VLAN corresponding with the second VLAN ID, judge whether the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, if the first surplus resources, the second surplus resources and the 3rd surplus resources are all greater than first resource demand, respectively the first surplus resources, the second surplus resources and the 3rd surplus resources are deducted to described first resource demand, thereby upgrade surplus resources list, send authentication response information to network access server, wherein authentication response information comprises business admission instruction, if the first surplus resources, the second surplus resources or the 3rd surplus resources are not more than first resource demand, send authentication response information to network access server, wherein authentication response information comprises service denial instruction,
12. systems according to claim 11, is characterized in that:
Radius certificate server is the Radius certificate server that in claim 6-8, any one relates to;
Network access server is the network access server relating in claim 9 or 10.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210566946.5A CN103888435B (en) | 2012-12-24 | 2012-12-24 | For the methods, devices and systems of business admission control |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210566946.5A CN103888435B (en) | 2012-12-24 | 2012-12-24 | For the methods, devices and systems of business admission control |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103888435A true CN103888435A (en) | 2014-06-25 |
| CN103888435B CN103888435B (en) | 2017-06-23 |
Family
ID=50957157
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210566946.5A Active CN103888435B (en) | 2012-12-24 | 2012-12-24 | For the methods, devices and systems of business admission control |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103888435B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105592487A (en) * | 2014-10-22 | 2016-05-18 | 中兴通讯股份有限公司 | Evaluation method and apparatus for LTE network service flow |
| CN106411567A (en) * | 2016-08-30 | 2017-02-15 | 福建星网视易信息系统有限公司 | Method and device for automatically controlling the number of clients capable of being loaded by servers |
| CN106649471A (en) * | 2016-09-28 | 2017-05-10 | 新华三技术有限公司 | Access control method and apparatus |
| CN110995780A (en) * | 2019-10-30 | 2020-04-10 | 北京文渊佳科技有限公司 | API calling method and device, storage medium and electronic equipment |
| CN111711698A (en) * | 2020-07-01 | 2020-09-25 | 青岛亿联客信息技术有限公司 | Intelligent equipment network access method and device and intelligent equipment control system and method |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030051030A1 (en) * | 2001-09-07 | 2003-03-13 | Clarke James B. | Distributed metric discovery and collection in a distributed system |
| US20030051029A1 (en) * | 2001-09-07 | 2003-03-13 | Reedy Dennis G. | Dynamic provisioning of sevice components in a distributed system |
| US20070140258A1 (en) * | 2003-10-21 | 2007-06-21 | Peilong Tan | Method for dynamic bandwidth allocation in passive optical network |
| CN101136866A (en) * | 2007-10-15 | 2008-03-05 | 北京交通大学 | Integrated network communication layer service quality guaranteeing structure and operating method |
| CN101370263A (en) * | 2007-08-15 | 2009-02-18 | 华为技术有限公司 | Policy control method and system |
| CN101594295A (en) * | 2008-05-30 | 2009-12-02 | 原创信通电信技术(北京)有限公司 | IP Telecommunication Network edge gateway equipment resource management method based on threshold value control |
| CN101808405A (en) * | 2009-02-12 | 2010-08-18 | 华为技术有限公司 | Method, device and system for wireless resource management in wireless relay network |
| CN101964757A (en) * | 2010-10-29 | 2011-02-02 | 中国电信股份有限公司 | Method and system for controlling quality of multi-service portfolio |
-
2012
- 2012-12-24 CN CN201210566946.5A patent/CN103888435B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030051030A1 (en) * | 2001-09-07 | 2003-03-13 | Clarke James B. | Distributed metric discovery and collection in a distributed system |
| US20030051029A1 (en) * | 2001-09-07 | 2003-03-13 | Reedy Dennis G. | Dynamic provisioning of sevice components in a distributed system |
| US20070140258A1 (en) * | 2003-10-21 | 2007-06-21 | Peilong Tan | Method for dynamic bandwidth allocation in passive optical network |
| CN101370263A (en) * | 2007-08-15 | 2009-02-18 | 华为技术有限公司 | Policy control method and system |
| CN101136866A (en) * | 2007-10-15 | 2008-03-05 | 北京交通大学 | Integrated network communication layer service quality guaranteeing structure and operating method |
| CN101594295A (en) * | 2008-05-30 | 2009-12-02 | 原创信通电信技术(北京)有限公司 | IP Telecommunication Network edge gateway equipment resource management method based on threshold value control |
| CN101808405A (en) * | 2009-02-12 | 2010-08-18 | 华为技术有限公司 | Method, device and system for wireless resource management in wireless relay network |
| CN101964757A (en) * | 2010-10-29 | 2011-02-02 | 中国电信股份有限公司 | Method and system for controlling quality of multi-service portfolio |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105592487A (en) * | 2014-10-22 | 2016-05-18 | 中兴通讯股份有限公司 | Evaluation method and apparatus for LTE network service flow |
| CN106411567A (en) * | 2016-08-30 | 2017-02-15 | 福建星网视易信息系统有限公司 | Method and device for automatically controlling the number of clients capable of being loaded by servers |
| CN106649471A (en) * | 2016-09-28 | 2017-05-10 | 新华三技术有限公司 | Access control method and apparatus |
| CN110995780A (en) * | 2019-10-30 | 2020-04-10 | 北京文渊佳科技有限公司 | API calling method and device, storage medium and electronic equipment |
| CN111711698A (en) * | 2020-07-01 | 2020-09-25 | 青岛亿联客信息技术有限公司 | Intelligent equipment network access method and device and intelligent equipment control system and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103888435B (en) | 2017-06-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP3060018B1 (en) | Registration method and system for common service entity | |
| CN102316001B (en) | Virtual network connection configuration realizing method and network equipment | |
| CN103229478B (en) | A kind of method and apparatus determining virtual-machine drift | |
| CN105637805A (en) | Enhancing a mobile backup channel to address a node failure in a wireline network | |
| CN102710811B (en) | Realize method and the switch of dhcp address safety distribution | |
| CN109474481B (en) | Equipment deployment method and system, network management server, mobile terminal and storage medium | |
| CN110677405A (en) | Data processing method and device, electronic equipment and storage medium | |
| CN103888435A (en) | Service admission control method, device and system | |
| CN104253767A (en) | Virtual shard network implementing method and switch | |
| CN103780711A (en) | Address assignment method and address assignment system for intelligent access type decision, and AAA system | |
| CN103369529A (en) | Identity authentication method, access point (AP) and access controller (AC) | |
| CN111194035A (en) | Network connection method, device and storage medium | |
| US10205545B2 (en) | Resource creation method and apparatus | |
| CN104243625A (en) | IP address distribution method and device | |
| CN109104309B (en) | Edge server management system and method of CDN (content delivery network) | |
| CN105071965A (en) | Management system of network equipment | |
| CN110753093A (en) | Method and device for managing equipment in cloud computing system | |
| CN107995125B (en) | Traffic scheduling method and device | |
| CN102281299A (en) | Interactive service processing method and service control layer server | |
| CN115277001A (en) | Certificate distribution method, device, system and medium for co-building shared network | |
| CN104092560A (en) | Method and system for realizing clustering by connecting switch with controller, switch, and controller | |
| CN103178997A (en) | Same MAC (Media Access Control) address detection method and device based on LLDP (Link Layer Discovery Protocol) | |
| CN106411928A (en) | Authentication method and device of client access server and VDI system | |
| CN104158565B (en) | A kind of method and apparatus of carrier equipment management | |
| CN104579893A (en) | Transmission path control system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |