专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

EP3062466B1 NETWORK SECURITY METHOD AND DEVICE 有权
公开(公告)号：EP3062466B1
公开(公告)日：2019-05-08
申请号：EP14863034.6
申请日：2014-11-12
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , SUN, Bing , LI, Jun
IPC分类号： H04L12/701 , H04L9/00 , H04L29/06

2. 发明公开

EP3062466A1 NETWORK SECURITY METHOD AND DEVICE 有权
标题翻译： NETZWERKSICHERHEITSVERFAHREN UND -VORRICHTUNG
公开(公告)号：EP3062466A1
公开(公告)日：2016-08-31
申请号：EP14863034.6
申请日：2014-11-12
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , SUN, Bing , LI, Jun
IPC分类号： H04L12/701 , H04L9/00
CPC分类号： H04L63/20 , H04L63/0218 , H04L63/0236 , H04L63/104
摘要： Embodiments of the present invention provide a network security method and a device. The method includes: receiving, by a network device, a first data packet that includes a first security group tag (SGT), where the first SGT is used to identify a security group to which the first data packet belongs; recording a first correspondence, where the first correspondence is a correspondence between the first SGT and a source IP address of the first data packet; receiving a second data packet, where a destination IP address of the second data packet is the source IP address of the first data packet; acquiring the first SGT according to the destination IP address of the second data packet and the first correspondence; and acquiring, according to the acquired first SGT and a preset second correspondence, a network security policy and executing the policy on the second data packet, where the second correspondence is a correspondence between the first SGT and the network security policy.
摘要翻译：本发明的实施例提供一种网络安全方法和装置。该方法包括：由网络设备接收包括第一安全组标签（SGT）的第一数据分组，其中第一SGT用于标识第一数据分组所属的安全组; 记录第一对应关系，其中第一对应关系是第一SGT与第一数据包的源IP地址之间的对应关系; 接收第二数据分组，其中第二数据分组的目的地IP地址是第一数据分组的源IP地址; 根据第二数据包的目的IP地址和第一对应来获取第一SGT; 并且根据所获取的第一SGT和预设的第二对应关系，获取网络安全策略并对第二数据分组执行策略，其中第二对应关系是第一SGT与网络安全策略之间的对应关系。

3. 发明授权

EP3169036B1 PACKET PROCESSING METHOD, APPARATUS, AND DEVICE 有权
公开(公告)号：EP3169036B1
公开(公告)日：2020-02-26
申请号：EP16196618.9
申请日：2016-10-31
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , SUN, Bing
IPC分类号： H04L29/06 , H04L12/70

4. 发明公开

EP3169036A1 PACKET PROCESSING METHOD, APPARATUS, AND DEVICE 有权
标题翻译：分组处理方法，装置和设备
公开(公告)号：EP3169036A1
公开(公告)日：2017-05-17
申请号：EP16196618.9
申请日：2016-10-31
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , SUN, Bing
IPC分类号： H04L29/06 , H04L12/70
摘要： The present invention discloses a packet processing method, apparatus, and device, and relates to the field of communications technologies. The method includes: receiving, by a forwarding plane, an item from a control plane of the forwarding plane, where the item includes an identifier of a connected terminal; receiving an access protocol packet; when the forwarding plane determines that the access protocol packet is not an authentication start packet, determining, by the forwarding plane according to the identifier of the connected terminal, whether a terminal served by the access protocol packet is the connected terminal, where the authentication start packet is an authentication packet that is used to start an authentication process for a terminal served by the authentication start packet; and discarding, by the forwarding plane, the access protocol packet when the access protocol packet is not the authentication start packet and when the terminal served by the access protocol packet is not the connected terminal. The present invention can improve user experience.
摘要翻译：本发明公开了一种报文处理方法，装置和设备，涉及通信技术领域。该方法包括：转发平面接收来自转发平面的控制平面的物品，该物品包括连接终端的标识; 接收访问协议分组; 当所述转发平面确定所述接入协议报文不是认证开始报文时，所述转发平面根据所述连接终端的标识确定所述接入协议报文服务的终端是否为连接终端，所述认证开始分组是用于启动由认证开始分组服务的终端的认证过程的认证分组; 当所述接入协议报文不是所述认证开始分组时，以及所述接入协议分组服务的终端不是所述连接终端时，所述转发平面丢弃所述接入协议报文。本发明可以改善用户体验。

5. 发明授权

EP3462713B1 NAT ENTRY MANAGEMENT METHOD AND APPARATUS, AND NAT DEVICE 有权
公开(公告)号：EP3462713B1
公开(公告)日：2020-02-26
申请号：EP18196751.4
申请日：2018-09-26
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , WANG, Donghui , YANG, Rong
IPC分类号： H04L29/12

6. 发明公开

EP3462713A1 NAT ENTRY MANAGEMENT METHOD AND APPARATUS, AND NAT DEVICE 有权
公开(公告)号：EP3462713A1
公开(公告)日：2019-04-03
申请号：EP18196751.4
申请日：2018-09-26
申请人： Huawei Technologies Co., Ltd.
发明人： XU, Yibin , WANG, Donghui , YANG, Rong
IPC分类号： H04L29/12
摘要： A NAT entry management method and apparatus, and a NAT device are disclosed. The method includes: receiving and storing, by a NAT device, a connection parameter, where the connection parameter includes an address of a controller; receiving a packet sent by a network device, where a source address of the packet is a private address of the network device and a destination address of the packet is the address of the controller; performing NAT on the packet, where an after-NAT source address of the packet is a public address; and when a static entry condition is met, generating a target static NAT entry, where the target static NAT entry includes a correspondence between the private address of the network device, a before-NAT source port number of the packet, an after-NAT source port number of the packet, and the address of the controller, and the static entry condition includes that the destination address of the packet is the address of the controller. This can prevent aging of the NAT entry from affecting communication between the network device and the controller.

7. 发明公开

EP3013020A1 METHOD, DEVICE AND SYSTEM FOR TRANSMITTING PACKET IN MULTICAST DOMAIN NAME SYSTEM 有权
标题翻译： VERFAHREN，VORRICHTUNG UND SYSTEM ZURPAKETÜBERTRAGUNGIN EINEM MULTICAST-DOMENNENNAMENSYSTEM
公开(公告)号：EP3013020A1
公开(公告)日：2016-04-27
申请号：EP14822797.8
申请日：2014-07-01
申请人： Huawei Technologies Co., Ltd.
发明人： WANG, Chunning , XU, Yibin
IPC分类号： H04L29/12
CPC分类号： H04L61/1511 , H04L12/18 , H04L12/4641 , H04L61/1541 , H04L61/6013 , H04L67/16
摘要： The present invention discloses a packet transmission method, apparatus, and system in a multicast domain name system mDNS, which are used to resolve a network bandwidth waste problem because generally much service information needs to be transmitted in an mDNS-based network. The method includes: converting, by a relay, a Known-Answer service query packet that is sent by a user terminal and used to query service information in an mDNS, into a unicast Known-Answer service query packet and sending the unicast Known-Answer service query packet to a gateway; receiving, by the relay, a unicast Known-Answer service answer packet that is sent by the gateway and includes service information unknown to the user terminal; and converting, by the relay, the unicast Known-Answer service answer packet into a multicast Known-Answer service answer packet and sending the multicast Known-Answer service answer packet to the user terminal.
摘要翻译：本发明公开了一种组播域名系统mDNS中的分组传输方法，装置和系统，用于解决网络带宽浪费问题，因为在基于mDNS的网络中需要传送大量服务信息。该方法包括：通过中继将由用户终端发送并用于查询mDNS中的服务信息的已知应答服务查询分组转换为单播已知应答业务查询报文，并发送单播已知应答业务查询报文到网关; 由所述中继器接收由所述网关发送的单播已知应答服务应答分组，并且包括所述用户终端未知的服务信息; 并通过中继将单播已知应答业务应答报文转换为组播已知应答业务应答报文，并向用户终端发送组播已知应答业务应答报文。

8. 发明公开

EP4192063A1 ACCESS MANAGEMENT METHOD, AUTHENTICATION POINT, AND AUTHENTICATION SERVER 审中-实审
公开(公告)号：EP4192063A1
公开(公告)日：2023-06-07
申请号：EP21857421.8
申请日：2021-07-14
申请人： Huawei Technologies Co., Ltd.
发明人： HE, Bin , WENG, Cairen , XU, Yibin , WANG, Sisheng
IPC分类号： H04W12/06
摘要： This application discloses an access management method, an authenticator, and an authentication server, applied to a scenario in which a terminal device accesses a network (for example, a campus network). After completing authentication, a terminal device sends a first packet to an authenticator, where the first packet carries a first IPv6 address of the terminal device and a MAC address of the terminal device. When determining that the first IPv6 address is a new IPv6 address, the authenticator sends, to an authentication server, a second packet carrying the first IPv6 address and the MAC address, so as to indicate the authentication server to send a first authorization policy to a policy enforcement point based on the first IPv6 address. The authenticator can send the new IPv6 address to the authentication server, to enable the authentication server to formulate the first authorization policy for network admission based on the first IPv6 address. Therefore, a service packet of the terminal device can be transmitted, through the policy enforcement point, to an address or a network segment that allows a user to access. Therefore, even if the IPv6 address of the terminal device changes, it can be ensured, as much as possible, that a service is not interrupted.

9. 发明授权

EP3013020B1 METHOD, DEVICE AND SYSTEM FOR TRANSMITTING PACKET IN MULTICAST DOMAIN NAME SYSTEM 有权
公开(公告)号：EP3013020B1
公开(公告)日：2019-01-02
申请号：EP14822797.8
申请日：2014-07-01
申请人： Huawei Technologies Co., Ltd.
发明人： WANG, Chunning , XU, Yibin
IPC分类号： H04L29/12 , H04L29/08 , H04L12/18 , H04L12/46

10. 发明授权

EP3001635B1 METHOD, DEVICE AND SYSTEM FOR CONTROLLING ACCESS OF USER TERMINAL 有权
标题翻译：用于控制用户终端访问的方法，设备和系统
公开(公告)号：EP3001635B1
公开(公告)日：2017-06-07
申请号：EP14822073.4
申请日：2014-07-01
申请人： Huawei Technologies Co., Ltd.
发明人： SUN, Bing , XU, Yibin , TANG, Penghe
IPC分类号： H04L29/06 , H04W12/08 , H04W12/06 , H04L29/08 , H04L29/12
CPC分类号： H04L63/0876 , H04L61/6022 , H04L63/102 , H04L67/141 , H04W12/06 , H04W12/08
摘要： The present invention discloses a method, an apparatus, and a system for controlling access of a user terminal, where the method includes: receiving, by a controller, an authentication packet sent by an access switching node through an established data tunnel; obtaining, by the controller, a MAC address in a source MAC address field of the authentication packet; after access authentication implemented on a user terminal corresponding to the obtained MAC address succeeds, determining, from a maintained correspondence between a MAC address of a user terminal and an interface identifier, an interface identifier corresponding to the MAC address of the successfully-authenticated user terminal, where the interface identifier is an interface identifier of an interface on the access switching node connected to the user terminal; and sending, by the controller, the determined interface identifier to the access switching node through a control tunnel established between the controller and the access switching node, and instructing the access switching node to enable the interface corresponding to the interface identifier. In this way, network security can be improved in a case in which an implementation procedure of access authentication implemented on a user terminal is simplified.
摘要翻译：本发明公开了一种控制用户终端接入的方法，装置和系统，所述方法包括：控制器接收接入交换节点通过建立的数据隧道发送的认证报文; 所述控制器获取所述认证报文的源MAC地址字段中的MAC地址; 在所述获取的MAC地址对应的用户终端上实现的接入认证成功后，根据维护的用户终端的MAC地址与接口标识的对应关系，确定所述认证成功的用户终端的MAC地址对应的接口标识所述接口标识为所述用户终端连接的接入交换节点上的接口的接口标识; 所述控制器通过所述控制器与所述接入交换节点之间建立的控制通道向所述接入交换节点发送所述确定的接口标识，并指示所述接入交换节点启用所述接口标识对应的接口。这样，在用户终端实现接入认证的实现过程简化的情况下，可以提高网络安全性。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式