WO2022083492A2 - 一种智能卡管理装置的分布式管理***及管理方法 - Google Patents

一种智能卡管理装置的分布式管理***及管理方法 Download PDF

Info

Publication number
WO2022083492A2
WO2022083492A2 PCT/CN2021/123685 CN2021123685W WO2022083492A2 WO 2022083492 A2 WO2022083492 A2 WO 2022083492A2 CN 2021123685 W CN2021123685 W CN 2021123685W WO 2022083492 A2 WO2022083492 A2 WO 2022083492A2
Authority
WO
WIPO (PCT)
Prior art keywords
smart card
card management
management device
terminal
proxy module
Prior art date
Application number
PCT/CN2021/123685
Other languages
English (en)
French (fr)
Other versions
WO2022083492A3 (zh
Inventor
周林林
王凯航
周好
Original Assignee
上海途鸽数据科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海途鸽数据科技有限公司 filed Critical 上海途鸽数据科技有限公司
Priority to EP21881910.0A priority Critical patent/EP4216588A4/en
Priority to JP2023524195A priority patent/JP7480434B2/ja
Publication of WO2022083492A2 publication Critical patent/WO2022083492A2/zh
Publication of WO2022083492A3 publication Critical patent/WO2022083492A3/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/35—Protecting application or service provisioning, e.g. securing SIM application provisioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4535—Network directories; Name-to-address mapping using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Definitions

  • Embodiments of the present invention relate to a smart card expansion technology, in particular to a distributed management system and a management method of a smart card management device.
  • a smart card management device In the cloud communication industry, it is often necessary to use a smart card management device to manage a large number of smart cards.
  • a smart card is not only a credential for providing services to customers, but also a tangible asset of the company in the industry. Therefore, how to maximize the use of these smart card resources has always been one of the directions that the industry is constantly exploring. And how to effectively manage these large numbers of smart cards is the premise to maximize the utilization of this resource.
  • FIG. 1 A service architecture for managing smart cards is provided in the prior art, as shown in FIG. 1 .
  • the architecture in Figure 1 mainly consists of three independent modules:
  • Business service module used to process business-related affairs, including the legality verification of terminal equipment, the graphical presentation of the smart card management device, the centralized allocation of smart card resources, and other functions.
  • Smart card management device used to collect smart card information in the smart card management device, and provide functions such as permission verification for each terminal to access the network to the outside.
  • Terminal a product that is ultimately leased or sold to users to provide users with network access functions.
  • the first stage 1
  • the smart card management device collects all the smart card information under it and reports it to the business service module for subsequent centralized allocation.
  • the business service module verifies the identity of the smart card management device, and records its reporting information and its location information (such as IP, etc.) after the verification is passed;
  • the business service module After the business service module completes the information recording, it pushes the corresponding status to the smart card management device and notifies it to provide services to the outside world. After that, the smart card management device and the business service module continue to keep in touch to synchronize the change information in real time. The first stage is now complete.
  • the second stage 3 After the terminal is enabled by the user, it starts to contact the business service module and apply for smart card resources;
  • the business service module allocates smart card resources to the terminal after confirming the identity of the terminal, and informs its resource location. At the same time, it also synchronizes the information to the smart card management device, so that it can be authenticated when the subsequent terminal comes to apply for service. After that, the terminal and the business service module continue to keep in touch to synchronize the change information in real time. The second stage is now complete.
  • the third stage 5 After the terminal obtains the smart card resource, it initiates a service application to the smart card management device according to its location information;
  • the smart card management device performs identity authentication after receiving the service application of the terminal, and starts to serve it after confirming the identity, and finally realizes the network access of the device.
  • the terminal in FIG. 1 itself has two sets of network access, one of which can directly access the first network, and communicate with the service service module and the smart card management device through the first network; After the work, the second network access is realized and finally provided to the user.
  • the advantages of the existing architecture shown in FIG. 1 are that the architecture is simple and the deployment is convenient.
  • the disadvantages of this architecture are gradually magnified. Its main disadvantages are as follows:
  • the smart card management device must have a fixed IP
  • the network routing from the smart card management device to the terminal cannot be optimized (for example, the smart card management device is located in Shanghai, and the terminal is located in Shanghai. in New York, Tokyo, Paris, etc.).
  • an effective method is to rent IDC computer rooms in many places around the world for the installation of smart card management devices. operating costs.
  • the smart card management device In the current architecture, the smart card management device often uses a fixed node service entry, or even a single node entry, which will greatly reduce the disaster tolerance of the entire service. That is, when the entry node fails, all smart card management devices cannot provide external services. Therefore, such a failure situation will completely paralyze the operation of the entire product.
  • At least one embodiment of the present invention provides a distributed management system and management method of a smart card management device, which are used to realize deployment flexibility of the smart card management device and reduce operating costs.
  • an embodiment of the present invention provides a distributed management system for a smart card management device, including:
  • Business service devices multiple smart card management devices, and multiple terminals belonging to the service center;
  • the business service device includes a business service center and at least one proxy module, and after each terminal and the smart card management module are registered in the business service center, the authentication processing of the terminal by the smart card management device is realized through the proxy module allocated by the business service center, to enable the terminal to access the network where the terminal is located;
  • the smart card management device that performs authentication processing for the terminal is located in the area where the terminal is located, and each agent module is connected to a plurality of distributed deployment smart card management devices.
  • the proxy module and the business service center are both located in the IDC computer room and share a public network address, that is, a public network IP address, and each smart card management device located in the area where the terminal is located has a preconfigured
  • the public network address is the public network IP address.
  • the business service center when there are multiple proxy modules, the business service center is located in the IDC computer room or the cloud, the proxy modules are deployed in a distributed manner according to the region where the terminal is located, and each proxy module has a pre-configured public network address ;
  • Each smart card management device connected to each proxy module is configured with an intranet address, and the proxy module implements point-to-point/end-to-end communication between the smart card management device that performs authentication processing for the terminal and the terminal.
  • the proxy module is further configured to forward the interaction data between the smart card management device and the business service center;
  • All the agent modules connected to the business service center form a star topology, and any two agent modules are interconnected, and/or the business service center is located in the cloud or hybrid cloud of the service provider.
  • an embodiment of the present invention provides a management method for a distributed management system, wherein the distributed management system includes: a plurality of proxy modules with public network addresses that are distributed and deployed connected to a business service center, each The proxy module is connected to a plurality of smart card management devices configured with intranet addresses, and a plurality of terminals for accessing the network where the terminal is located (ie, the second network).
  • the management method includes:
  • the proxy module registers with the business service center, and acquires the information of the smart card management device used by the proxy module for service, and interacts with the smart card management device for service to obtain the access service used by the smart card management device for the service terminal Entry information, and send the access service entry information to the business service center;
  • the proxy module receives an authentication request sent by the terminal for performing authentication to the smart card management device, where the authentication request is sent by the terminal after receiving the access service entry information and the address information of the proxy module allocated by the service service center. Yes, the authentication request includes the smart card information paired with the terminal determined by the business service center;
  • the proxy module searches for the smart card management device to which it belongs according to the smart card information, so that the smart card management device processes the authentication request, so that the terminal accesses the second network.
  • S1 includes:
  • the agent module sends a registration request to the business service center, and the registration request includes the identification and location information of the agent module;
  • the proxy module receives the registration response fed back by the business service center and the information of the smart card management device used for the service by the proxy module, and starts the access service according to the information of the smart card management device;
  • the proxy module receives an access registration message initiated by a smart card management device, where the access registration message is a message sent by the smart card management device according to the address information of the proxy module pushed by the business service center;
  • the proxy module feeds back registration status information according to the access registration message, establishes a connection with the smart card management device, and synchronizes the access status of the smart card management device and the access service for the service terminal to the service service center Entry information.
  • the S3 includes:
  • the proxy module judges whether the smart card management device and the terminal are both in a full cone NAT (Full Cone NAT) network environment according to the network environment where the smart card management device and the terminal are located in advance;
  • the proxy module forwards the authentication request to the found smart card management device
  • the proxy module receives the processing result of the authentication request by the smart card management device, and sends the processing result to the terminal, so that the terminal can access the second network;
  • the network environment of the smart card management device is the information carried when the smart card management device initiates the access registration message
  • the network environment of the terminal is the information carried when the terminal initiates an authentication request.
  • the method further includes:
  • the proxy module periodically sends heartbeat information including the state of the proxy module to the business service center;
  • the proxy module When the proxy module receives a connection request sent by a terminal that is not in the area to which the proxy module belongs, the proxy module sends, according to the connection request, to the service service center information that the proxy module in the area to which the terminal belongs is faulty.
  • an embodiment of the present invention further provides a method for managing a distributed management system, wherein the distributed management system includes: a plurality of distributed deployments connected to a business service center with public network addresses (ie, public network IP addresses) address), each proxy module is connected to a plurality of smart card management devices configured with intranet addresses, and a plurality of terminals used to access the network where the terminal is located (ie, the second network), and the management method includes:
  • the business service center receives the smart card information reported by each smart card management device and the location information of the smart card management device;
  • the business service center receives a registration request sent by each proxy module, and the registration request includes the identification and location information of the proxy module that sends the registration information;
  • the business service center According to the location information of the proxy module and the location information of the smart card management device, the business service center returns to each proxy module the information of the smart card management device used by the proxy module to serve, so that each proxy module can be based on the information of the smart card management device. enable access service;
  • the business service center After receiving the access service opening information returned by the proxy module, the business service center pushes the address information of the proxy module used for the service to each smart card management device, so that the smart card management device is in the corresponding proxy module register;
  • the business service center receives the access service entry information and access status of all smart card management devices served by the proxy module fed back by the proxy module;
  • the service service center receives an application request sent by the terminal for applying for smart card resources, where the application request includes: the location information of the terminal and the operator network information where the terminal is located;
  • the business service center distributes the access service entry information of the smart card management device and the address information of the proxy module according to the application request; After the terminal accesses the proxy module, it interacts with the smart card management device that it is connected to, and accesses the second network.
  • the method further includes:
  • the business service center sends the address information of the first preset number of adjacent proxy modules to the registered proxy modules according to the interconnection strategy, so that the proxy modules communicate with the adjacent proxy modules;
  • the business service center sends the address information and priority information of the second preset number of proxy modules to the registered smart card management device or terminal according to the interconnection policy, so that the smart card management device or terminal stores the second preset number of proxy modules. address information of the module, and select a proxy module connection according to the priority information.
  • the smart card management device is deployed in a distributed manner and can be deployed in the area where the terminal is located, thereby realizing the deployment flexibility of the smart card management device and reducing operating costs.
  • one proxy module can be connected to a plurality of smart card management modules deployed in a distributed manner, thereby solving the problem of the harsh network environment required for deploying smart card management devices in the private network environment of the prior art problems, effectively reducing operating costs.
  • proxy modules deployed in a distributed manner can realize interconnection and intercommunication.
  • other normal proxy module nodes in the network can quickly become the disaster recovery nodes of the faulty node and continue to provide services for the terminal, so that the terminal can be realized.
  • FIG. 1 is a schematic diagram of a service architecture method of a smart card management device provided in the prior art
  • FIG. 2A and FIG. 2B are respectively an architecture diagram of a distributed management system of a smart card management device provided by an embodiment of the present invention.
  • FIG. 3A to FIG. 3C are respectively an architecture diagram of a distributed management system of a smart card management device provided by another embodiment of the present invention.
  • FIG. 3A and 4B are both schematic diagrams of the management method of the distributed management system shown in FIG. 3A;
  • FIG. 5 to FIG. 7 are respectively partial schematic flowcharts of a management method of a distributed management system provided by an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a scenario of service transfer when a proxy module shown in FIG. 3C fails.
  • this embodiment provides an architecture diagram of a distributed management system of a smart card management device.
  • the distributed management system in this embodiment includes: a business service device belonging to a service center, a plurality of smart card management devices, multiple terminals.
  • the business service device in this embodiment includes a business service center and an agent module. After each terminal and the smart card management module are registered in the business service center, the authentication of the terminal by the smart card management device is realized through the agent module allocated by the business service center. processing, so that the terminal accesses the network where the terminal is located (hereinafter referred to as the second network).
  • the proxy module connects multiple smart card management apparatuses and multiple terminals.
  • proxy module there is one proxy module, the proxy module and the business service center are both located in the IDC computer room or the cloud, wherein the proxy module and the business service center share a public network address, such as an IPv4/IPv6 address, at this time,
  • a public network address such as an IPv4/IPv6 address
  • the smart card management device in this embodiment can realize distributed deployment, that is, flexible deployment in the area where the terminal is located, that is, the smart card management device and the terminal belong to the same country or region or the same telecom operator network as far as possible.
  • the smart card management device is “moved away” from the computer room; it is “closer” to the terminal as much as possible to realize flexible deployment of the smart card management device and optimize the network routing between the smart card management device and the terminal.
  • each smart card management device "moved out" of the computer room is preconfigured with a public network address, such as an IP address, that is, each smart card management device located in the area where the terminal is located has a preconfigured public network address.
  • the smart card management apparatus in this embodiment can be implemented as an authentication process for a terminal, so that the terminal can access the second network where the terminal belongs.
  • the business service center and the agent module can be presented as a business service module.
  • the interaction between the smart card management device and the terminal and the business service module in FIG. 2A and FIG. 2B is basically the same as the interaction in the prior art. Referring to the prior art The process of 1 to 6 in the above is to realize the authentication of the terminal, which is not described in detail here in this embodiment.
  • a smart card ie, a SIM card
  • the authentication request will be transmitted to the SIM card for calculation.
  • Relevant algorithms and keys are preset in the SIM card, so the authentication process of the mobile phone device by the operator's network can be realized, and then the mobile phone can connect to the operator's network through the internal smart card.
  • the SIM card is installed on the smart card management device.
  • the terminal wants to connect to the operator network where the terminal is located, the authentication request from the operator network where the terminal is located will be transmitted to the smart card management device through the first network, and finally the smart card management device This process is completed on the above, and returned to the terminal, so that the terminal is connected to the second network where the terminal is located by means of the SIM card in the smart card management device.
  • the first network may be the carrier network where the terminal belongs before roaming
  • the second network is the carrier network where the terminal is located after the terminal roams, and the terminal needs to connect to the second network, which can be managed based on the first network and the smart card.
  • the device communicates to complete the access to the second network.
  • this embodiment provides another distributed management system, as shown in FIG. 3A , FIG. 3B and FIG. 3C . Move out the agent module located in the IDC computer room and deploy it in a distributed manner, and pre-configure the public network IP address for each agent module moved out of the IDC computer room.
  • one agent module can be connected to multiple smart card management devices, multiple smart card management devices
  • the public network IP address configured on the smart card management device can be reduced, and the flexible deployment of the smart card management device can also be realized, and the network routing between the smart card management device and the terminal can be optimized, and the operation cost can be effectively reduced.
  • this embodiment provides an architecture diagram of a distributed management system of another smart card management device.
  • the distributed management system in this embodiment includes: a business service device belonging to a service center, a plurality of smart card management devices , multiple terminals.
  • the business service device in this embodiment includes a business service center and two or more proxy modules. After each terminal and the smart card management module are registered in the business service center, the smart card management device can connect the terminal to the terminal through the proxy module allocated by the business service center. authentication processing, so that the terminal can access the network where the terminal is located, that is, the second network.
  • the business service center is located in the IDC computer room, the proxy modules are deployed in a distributed manner according to the region where the terminal is located, and each proxy module has a pre-configured public network IP address.
  • the agent module belongs to a node (called a European node) deployed in the European region.
  • each smart card management device connected to the European node is deployed in each local area network in the European region, that is, it has the IP address of the intranet
  • the proxy module with the public network IP address is convenient for forwarding or exchanging data between the terminal and the smart card management device, so as to realize P2P (point-to-point/end-to-end) communication between the smart card management device and the terminal.
  • the public network address in this embodiment is the public network IP address.
  • the public network address is used in some descriptions, and the public network IP address is used in some descriptions.
  • the four proxy modules may include: a proxy module as an Asia-Pacific node (set in the Asia-Pacific region), a Latin American node as a proxy module Proxy module (set in Latin America region), proxy module as Japan-Korea node (set in Japan-Korea region), and proxy module as European node (set in Europe region).
  • a proxy module as an Asia-Pacific node (set in the Asia-Pacific region)
  • a Latin American node as a proxy module Proxy module
  • proxy module as Japan-Korea node (set in Japan-Korea region)
  • proxy module as European node (set in Europe region).
  • This embodiment does not limit the number of proxy modules, and the number of proxy modules and the deployment area can be set according to actual needs.
  • the business service center may be a global multi-node deployed service platform.
  • the business service center may be located in a cloud or a hybrid cloud of a service provider.
  • the proxy modules of each global node After the proxy modules of each global node are activated, they need to be connected to the business service center (ie, the registration process of the proxy modules described below), so that the service center can clearly understand the location and activity status of each proxy module. Further, the business service center dynamically updates the positions of other proxy modules to each proxy module, so that they know each other's existence.
  • the above-mentioned distributed management system realizes the operation of "moving out” the smart card management device from the IDC room, providing realistic conditions for its distributed deployment.
  • the smart card management device can also be placed in the user's home or even carried around.
  • FIG. 4A and FIG. 4B show signaling diagrams of two overall interaction processes.
  • 5 shows the flow chart of the business service center as the execution body
  • FIG. 6 shows the flow chart of the proxy module as the execution body
  • FIG. 7 shows a partial flow chart of the proxy module as the repeater.
  • the initial registration process between the smart card management device, the terminal and the service service center is basically the same as the existing solution, and the smart card management device and the terminal are connected.
  • the interaction process is completed through the proxy module.
  • the proxy module can choose to implement one of two functions according to the network environment where the smart card management device and the terminal are located: 1. a repeater (proxy server); 2. a P2P connection switch.
  • the terminal needs to pass the proxy module to access the smart card management device, and the proxy module at this time can realize the function of the repeater;
  • the proxy module can exchange the addresses of the smart card control device and the terminal, and then the smart card management device and the terminal directly interact, that is, the proxy module realizes the function of the P2P connection switch.
  • the above-mentioned proxy module realizes the P2P communication between the smart card management device and the terminal.
  • the executive body of the management method in this embodiment is a business service center, and the management method may include:
  • the business service center receives the smart card information reported by each smart card management device and the location information of the smart card management device.
  • the smart card information may include: IMSI, ICCID and other in-card file information of the smart card; the number of the smart card on the smart card management device; the serial number and network address of the smart card management device.
  • the location information of the smart card management device may be network address information.
  • the business service center receives a registration request sent by each proxy module, and the registration request may include the identity and location information of the proxy module that sends the registration information.
  • the registration request may include information such as the serial number and verification code of the proxy module.
  • the location information of the proxy module is mainly network address information (that is, a public network entrance). In this embodiment, other preconfigured information may be determined according to the network address information.
  • the business service center According to the location information of the agent module and the location information of the smart card management device, the business service center returns to each agent module the information of the smart card management device used by the agent module for service, so that each agent module opens the connection according to the information of the smart card management device. into the service.
  • the business service center will allocate according to the pre-configured proxy module allocation strategy.
  • the business service center After receiving the access service opening information returned by the proxy module, the business service center pushes the address information of the proxy module used for the service (such as the network address information with the public network IP) to each smart card management device, so that the The smart card management device is registered in the corresponding agent module.
  • the address information of the proxy module used for the service such as the network address information with the public network IP
  • the business service center receives the access service entry information and access status of all smart card management devices served by the proxy module fed back by the proxy module.
  • the normal access state can be normal state and abnormal state, and so on.
  • the access service entry information may be information such as an IP address and an access port with a public network entry for the terminal to identify and access.
  • the service service center receives an application request sent by the terminal for applying for smart card resources, where the application request includes: location information of the terminal.
  • the location information of the terminal may be the geographic location where the terminal is currently located, such as longitude and latitude information.
  • the application request may further include: operator network information where the terminal is located, and the like.
  • the business service center distributes the access service entry information of the smart card management device and the network address information of the proxy module according to the location information, so that the terminal can interact with the smart card management device after accessing the proxy module and access the second network.
  • the business service center receives the registration of the agent module and the registration of the smart card management device in no particular order, and either receives the registration of the smart card management device first, or the registration of the agent module first, as shown in FIG. 4A and FIG. 4B What is shown is that the process that the smart card management device first registers with the service service center is for illustration.
  • the executive body of the management method of the present embodiment is an agent module, and the management method may include:
  • the proxy module registers with the business service center, and acquires the information of the smart card management device used by the proxy module for service, and interacts with the smart card management device for service to obtain the access service entry information used by the smart card management device for the service terminal , and send the access service entry information to the business service center.
  • this step S1 may include the following sub-steps:
  • the proxy module sends a registration request to the business service center, and the registration request includes the identity and location information of the proxy module;
  • the proxy module receives the registration response fed back by the business service center and the information of the smart card management device used for the service by the proxy module, and starts the access service according to the information of the smart card management device.
  • the proxy module receives an access registration message initiated by the smart card management device, where the access registration message is a message sent by the smart card management device according to the address information of the proxy module pushed by the service service center.
  • the smart card management apparatus may further carry the network environment status information of the smart card management apparatus in the access registration message.
  • the access registration message may include information such as smart card information and its serial number in the smart card management device.
  • the proxy module feeds back registration status information according to the access registration message, establishes a connection with the smart card management device, and synchronizes the access status of the smart card management device and the connection for the service terminal to the service service center. Enter service entry information.
  • the access service entry information in this embodiment includes IP information having a public network entry, port information, and the like.
  • the proxy module receives an authentication request sent by the terminal for performing authentication to the smart card management device, and the authentication request is sent by the terminal after receiving the access service entry information and the address information of the proxy module allocated by the service service center,
  • the authentication request includes the information of the smart card paired with the terminal determined by the service service center.
  • the terminal may also send a connection request to the proxy module, where the connection request carries information used for authentication and carries information about the state of the network environment where the terminal is located.
  • the authentication request mentioned above carries the authentication information and the network environment state information where the terminal is located.
  • the terminal or smart card management device can detect its own network environment through the STUN (Simple Traversal of UDP over NATs, UDP simple traversal of NAT) protocol.
  • STUN Simple Traversal of UDP over NATs, UDP simple traversal of NAT
  • the proxy module searches for the smart card management device to which it belongs according to the smart card information, so that the smart card management device processes the authentication request, so that the terminal accesses the second network.
  • the proxy module can implement the communication between the smart card management device and the terminal according to the process shown by the frame line in FIG. 4A , or the proxy module can implement the smart card management device and the terminal according to the process shown by the frame line in FIG. 4B . communication between.
  • the S3 may include:
  • the proxy module determines whether the smart card management device and the terminal are both in a completely conical NAT network environment according to the pre-acquired network environment where the smart card management device and the terminal are located.
  • P2P communication refers to point-to-point, end-to-end communication.
  • Two terminal devices in a complete cone environment can be directly connected to communicate, and devices that are not in such a network environment can communicate through an intermediate proxy mode, which is also called P2P communication in this embodiment.
  • the proxy module forwards the authentication request to the found smart card management device;
  • the proxy module receives the processing result of the authentication request by the smart card management device, and sends the processing result to the terminal, so that the terminal can access the second network;
  • the network environment of the smart card management device is the information carried when the smart card management device initiates the access registration message
  • the network environment of the terminal is the information carried when the terminal initiates an authentication request.
  • FIGS. 4A to 6 may include the following steps not shown in the figures:
  • the proxy module periodically sends heartbeat information including the state of the proxy module to the business service center;
  • the proxy module When the proxy module receives a connection request sent by a terminal in an area not belonging to the proxy module, the proxy module sends, according to the connection request, to the service service center information that the proxy module in the area to which the terminal belongs is faulty.
  • each proxy module is connected to the service center, and each proxy module is also connected to the other three proxy modules, so that all proxy modules form a mesh topology, and business services Between the center and the agent module is a star topology. Therefore, when a node in the proxy module fails, on the one hand, apart from the service center and other proxy modules, the fault can be sensed in time and the corresponding services of the faulty node can be quickly and dynamically supported. In addition to the smooth transition of failures, on the other hand, it can also alert the operation and maintenance personnel of the risk in multiple ways and restore it.
  • the proxy module of the European node fails.
  • the abnormal situation can be known from three aspects (ie, the terminal, the business service center, and other agent modules).
  • the smart card management device is also connected to the service center in the architecture shown in FIG. 2A and FIG. 2B , there are four aspects (ie, the terminal, the business service center, other agent modules, and the smart card management device) that can know that the “European node” occurs unusual fact. Therefore, the false positive rate of any one proxy module failure is very low.
  • each terminal can be preset with the location information of all proxy modules (that is, the public network IP address information), and when its default proxy module is unavailable, switch other nodes in turn;
  • the smart card management device When both the smart card management device and the terminal are preset with the public network IP address information of all the proxy modules, the smart card management device will connect with all the proxy modules after being started. When a proxy module fails, the terminal can trigger the transfer to other proxy modules by itself, and the smart card management device itself is connected to all other proxy modules, so as long as the terminal is connected to other proxy modules, it can The smart card management device communicates.
  • Another possible implementation is that when the terminal connects to the faulty proxy module, it can notify the business service center of the abnormal situation of the proxy module, and the business service center allocates the information, thereby realizing dynamic routing.
  • the terminal when it detects that it cannot connect to its default "European node” proxy module, it sends a service request to the "Asia- Pacific node” according to the information of the preset proxy module. Since the "Asia-Pacific node” has previously normally connected and exchanged information with the European node, and the smart card management device is also connected to it. At this time, the "Asia-Pacific Node” agent module can directly forward the service request of the terminal to the smart card management device.
  • the location information of all the proxy modules can be preset in the smart card management device and the terminal in advance, and all the proxy modules are interconnected.
  • this embodiment provides the following connection strategies:
  • Each proxy module is only connected to a maximum of 8 other proxy modules
  • the proxy modules deployed in a distributed manner can realize interconnection and intercommunication.
  • other normal proxy module nodes in the network can quickly become the disaster recovery nodes of the faulty node and continue to provide services for the terminal, so that the To provide continuous service for the terminal, it can also optimize the quality of service.
  • the terminal in this embodiment is also used to record information such as time consumed by each authentication request, authentication time, terminal address location, used proxy module, etc., and periodically upload the recorded information to the business service center.
  • the service center can comprehensively evaluate the agent module according to the information periodically uploaded by the terminal.
  • the distributed management system of the embodiment of the present invention dynamically adjusts the binding relationship between the terminal and the agent module to optimize the service quality of the system, thereby realizing dynamic routing and optimizing the service quality.
  • the execution sequence can be adjusted arbitrarily.
  • the disclosed apparatus and method can be implemented in other ways.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solutions of the embodiments of the present invention are essentially, or the parts that make contributions to the prior art or the parts of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.
  • a computer device which may be a personal computer, a server, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例涉及一种智能卡管理装置的分布式管理***及管理方法，***包括：属于服务中心的业务服务装置、多个智能卡管理装置、多个终端；所述业务服务装置包括业务服务中心和至少一个代理模块，所述每一个终端和智能卡管理模块在业务服务中心注册之后，通过业务服务中心分配的代理模块实现智能卡管理装置对终端的鉴权处理，以使所述终端接入终端所在地的第二网络；其中，为终端进行鉴权处理的智能卡管理装置位于终端所在的区域，且每一代理模块连接多个分布式部署的智能卡管理装置。本发明的***可实现智能卡管理装置的部署灵活性，降低了运营成本和对网络环境的限制。

Description

一种智能卡管理装置的分布式管理***及管理方法 技术领域
本发明实施例涉及智能卡扩展技术，具体涉及一种智能卡管理装置的分布式管理***及管理方法。
背景技术
在云通信行业中常常需要使用智能卡管理装置来实现对大量智能卡的管理。对于云通信行业来说，智能卡不仅是一种对客户提供服务的凭证，同时也是行业内公司主体的有形资产，因此如何最大化利用这些智能卡资源一直是行业内不断探索的方向之一。而如何有效管理这些大量的智能卡则是实现此资源利用最大化的前提。
现有技术中提供一种管理智能卡的服务架构，如图1所示。图1中的架构主要包含三大独立模块：
1)业务服务模块：用于处理业务相关事务，包括终端设备的合法性验证、智能卡管理装置的图形化呈现、智能卡资源的集中配给等等功能。
2)智能卡管理装置：用于收集该智能卡管理装置中的智能卡信息，并对外提供每一终端接入网络进行许可验证等功能。
3)终端：最终租赁或售卖给用户的产品，为用户提供网络接入功能。
结合图1中的①至⑥，其流程主要包含以下三个阶段：
第一阶段：①智能卡管理装置收集好其下所有智能卡信息并上报至业务服务模块以备后续集中配给使用。业务服务模块验证对智能卡管理装置进行身份验证，验证通过后记录其上报信息同时也记录下其位置信息(如IP等)；
②业务服务模块完成信息记录后，将相应状态推送至智能卡管理装置并通知其对外提供服务，此后智能卡管理装置与业务服务模 块之间继续保持联系以实时同步变更信息。此时第一阶段完成。
第二阶段：③终端被用户启用后，开始与业务服务模块进行联系并进行智能卡资源申请；
④业务服务模块确认终端身份后对其分配智能卡资源，并告知其资源位置，同时也将信息同步至智能卡管理装置，以备后续终端过来申请服务时，对其进行身份鉴别。此后终端与业务服务模块之间继续保持联络以实时同步变更信息。此时第二阶段完成。
第三阶段：⑤终端拿到智能卡资源后，根据其位置信息，向智能卡管理装置发起服务申请；
⑥智能卡管理装置收到终端的服务申请后对其进行身份鉴别，确认身份后开始对其进行服务，最终实现设备的网络接入。
也就是说，图1中的终端本身有两套网络接入，其一可直接接入第一网络，并通过此第一网络与业务服务模块及智能卡管理装置进行通信；其二需要在完成上述工作后，才实现第二网络接入，并最终提供给用户使用。
具体地，图1所示的现有架构的优点就是架构简单，部署方便。然而随着行业发展的不断深入以及应用需求广泛接纳，此架构的弊端也逐渐放大显现。其主要缺点有如下几个方面：
1)智能卡管理装置必须有固定IP；
2)由前面第一条的要求使得智能卡管理装置的安装环境有两个选择：要么为其单独购买固定IP及专线；要么将其放置于IDC机房以便于固定IP。因此，其使用成本便被大大提高。
3)由于智能卡管理装置一般都集中放置在全球某一IDC机房，而终端则分布于全球各地，因此从智能卡管理装置到终端之间的网络路由无法优化(例如：智能卡管理装置在上海，而终端在纽约、东京、巴黎等)。
4)为解决第3点的问题一个行之有效的方法是在全球多地租用IDC机房用于安装智能卡管理装置，然而随着而来的安装、运维、租金等费用又将大幅提升产品的运营成本。
5)当前架构方式，智能卡管理装置往往采用固定节点的服务入口，甚至单节点入口，因此将会使得整个服务的容灾性大大降低。即当入口节点出现故障时，所有的智能卡管理装置均无法对外提供服务。因此，此种故障情况下将会完全瘫痪整个产品的运营。
除了以上几点局限外，在业务发展上，随着与全球代理商的深入合作，越来越多的代理商或大、中型客户有对智能卡进行本地管理的需求。因此，现行方案天然地无法满足此需求。
发明内容
为了解决现有技术存在的问题，本发明的至少一个实施例提供了一种智能卡管理装置的分布式管理***及管理方法，用于实现智能卡管理装置的部署灵活性，并降低运营成本。
第一方面，本发明实施例提供一种智能卡管理装置的分布式管理***，包括：
属于服务中心的业务服务装置、多个智能卡管理装置、多个终端；
所述业务服务装置包括业务服务中心和至少一个代理模块，所述每一个终端和智能卡管理模块在业务服务中心注册之后，通过业务服务中心分配的代理模块实现智能卡管理装置对终端的鉴权处理，以使所述终端接入该终端所在地的网络；
其中，为终端进行鉴权处理的智能卡管理装置位于终端所在的区域，且每一代理模块连接多个分布式部署的智能卡管理装置。
可选地，所述代理模块为一个时，所述代理模块和业务服务中心均位于IDC机房中共用一公网地址即公网IP地址，位于终端所在区域的每一个智能卡管理装置具有预先配置的公网地址即公网IP地址。
在一些实施例中，在代理模块为多个时，所述业务服务中心位于IDC机房或云端，所述代理模块根据终端所在区域进行分布式部 署，且每一代理模块具有预先配置的公网地址；
每一代理模块连接的每一个智能卡管理装置配置有内网地址，且该代理模块实现为终端进行鉴权处理的智能卡管理装置与该终端进行点对点/端到端通信。
在一些实施例中，所述代理模块还用于转发所述智能卡管理装置与业务服务中心之间的交互数据；
连接业务服务中心的所有代理模块构成星形拓扑结构，任意两个代理模块之间互联互通，和/或，业务服务中心位于服务提供商的云端或混合云中。
第二方面，本发明实施例提供一种分布式管理***的管理方法，其中，所述分布式管理***包括：连接业务服务中心的分布式部署的多个具有公网地址的代理模块，每一代理模块连接多个配置有内网地址的智能卡管理装置，多个用于接入终端所在地的网络(即第二网络)的终端，所述管理方法包括：
S1、所述代理模块向业务服务中心注册，并获取该代理模块用于服务的智能卡管理装置的信息，以及与用于服务的智能卡管理装置交互，获取智能卡管理装置用于服务终端的接入服务入口信息，并将接入服务入口信息发送业务服务中心；
S2、所述代理模块接收终端发送的用于向智能卡管理装置进行鉴权的鉴权请求，所述鉴权请求为终端接收业务服务中心分配的接入服务入口信息和代理模块的地址信息后发送的，该鉴权请求包括，业务服务中心确定的与终端配对的智能卡信息；
S3、所述代理模块依据智能卡信息查找所属的智能卡管理装置，以使所述智能卡管理装置对所述鉴权请求进行处理，使得所述终端接入第二网络。
在一些实施例中，S1包括：
所述代理模块向业务服务中心发送注册请求，所述注册请求包 括该代理模块的标识和位置信息；
所述代理模块接收所述业务服务中心反馈的注册响应及该代理模块用于服务的智能卡管理装置的信息，并根据智能卡管理装置的信息开启接入服务；
所述代理模块接收智能卡管理装置发起的接入注册消息，所述接入注册消息为该智能卡管理装置根据业务服务中心推送的所述代理模块的地址信息发送的消息；
所述代理模块根据所述接入注册消息反馈注册状态信息，建立与智能卡管理装置的连接，并向所述业务服务中心同步所述智能卡管理装置的接入状态及用于服务终端的接入服务入口信息。
在一些实施例中，所述S3包括：
所述代理模块根据预先获取的所述智能卡管理装置与所述终端所处的网络环境，判断所述智能卡管理装置和所述终端是否均处于完全锥形的NAT(Full Cone NAT)网络环境；
若是，则将智能卡管理装置的地址信息发送所述终端，将所述终端的地址信息发送所述智能卡管理装置，以使所述终端和所述智能卡管理装置进行直接通信，以对终端进行鉴权处理；
否则，所述代理模块将所述鉴权请求转发查找到的智能卡管理装置；
所述代理模块接收所述智能卡管理装置对鉴权请求的处理结果，并将处理结果发送所述终端，以使所述终端接入第二网络；
其中，智能卡管理装置的网络环境为所述智能卡管理装置发起接入注册消息时携带的信息；
所述终端的网络环境为所述终端发起鉴权请求时携带的信息。
在一些实施例中，所述方法还包括：
所述代理模块周期性向业务服务中心发送包括该代理模块状态的心跳信息；
和/或，
所述代理模块接收到非代理模块所属区域的终端发送的连接请求时，所述代理模块根据所述连接请求，向业务服务中心发送该终端所属区域的代理模块发生故障的信息。
第三方面，本发明实施例还提供一种分布式管理***的管理方法，其中，所述分布式管理***包括：连接业务服务中心的分布式部署的多个具有公网地址(即公网IP地址)的代理模块，每一代理模块连接多个配置内网地址的智能卡管理装置，多个用于接入终端所在地网络(即第二网络)的终端，所述管理方法包括：
A1、业务服务中心接收每一智能卡管理装置上报的智能卡信息和该智能卡管理装置的位置信息；
A2、业务服务中心接收每一代理模块发送的注册请求，所述注册请求包括发送注册信息的代理模块的标识和位置信息；
A3、所述业务服务中心根据代理模块的位置信息、智能卡管理装置的位置信息，向各代理模块返回该代理模块用于服务的智能卡管理装置的信息，以使各代理模块根据智能卡管理装置的信息开启接入服务；
A4、所述业务服务中心在接收代理模块返回的接入服务开启的信息后，向各智能卡管理装置推送用于服务的代理模块的地址信息，以使所述智能卡管理装置在对应的代理模块中注册；
A5、所述业务服务中心接收所述代理模块反馈的代理模块服务的所有智能卡管理装置的接入服务入口信息及接入状态；
A6、所述业务服务中心接收终端发送的用于申请智能卡资源的申请请求，所述申请请求包括：终端的位置信息和终端所在地的运营商网络信息；
A7、所述业务服务中心根据申请请求分配智能卡管理装置的接入服务入口信息及代理模块的地址信息；以使终端接入代理模块之 后与其连接的智能卡管理装置交互，接入第二网络。
在一些实施例中，所述方法还包括：
所述业务服务中心根据互联互通策略，向注册的代理模块发送第一预设数量的相邻代理模块的地址信息，以使所述代理模块与相邻的代理模块连通；
和/或，
所述业务服务中心根据互联互通策略，向注册的智能卡管理装置或终端发送第二预设数量的代理模块的地址信息及优先级信息，以使智能卡管理装置或终端存储第二预设数量的代理模块的地址信息，并根据优先级信息选择一个代理模块连接。
可见，本发明实施例的至少一个实施例中，将智能卡管理装置进行分布式部署，且可以部署在终端所在的区域，实现了智能卡管理装置的部署灵活性，降低了运营成本。
此外，本发明实施例中借助于代理模块，可以实现一个代理模块连接多个分布式部署的智能卡管理模块，由此，解决了现有技术私网环境中部署智能卡管理装置需要的苛刻网络环境的问题，有效降低了运营成本。
进一步地，分布式部署的代理模块可实现互联互通，当部分代理模块出现故障时，网络内的其他正常代理模块节点可迅速成为故障节点灾备节点，继续为终端提供服务，从而可以实现为终端提供持续服务，还可以优化服务质量。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附 图获得其他的附图。
图1为现有技术提供的一种智能卡管理装置的服务架构方法的示意图；
图2A和图2B分别为本发明一实施例提供的智能卡管理装置的分布式管理***的架构图；
图3A至图3C分别为本发明另一实施例提供的智能卡管理装置的分布式管理***的架构图；
图4A和图4B均为图3A所示的分布式管理***的管理方法的示意图；
图5至图7分别为本发明一实施例提供的分布式管理***的管理方法的部分流程示意图；
图8为图3C所示的一个代理模块发生故障时业务转移的场景示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明的一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本发明保护的范围。
需要说明的是，在本文中，诸如“第一”和“第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。
实施例一
如图2A和图2B所示，本实施例提供一种智能卡管理装置的分布式管理***的架构图，本实施例分布式管理***包括：属于服务中心的业务服务装置、多个智能卡管理装置、多个终端。
本实施例中的业务服务装置包括业务服务中心和一个代理模块，所述每一个终端和智能卡管理模块在业务服务中心注册之后，通过业务服务中心分配的代理模块实现智能卡管理装置对终端的鉴权处理，以使所述终端接入该终端所在地的网络(下述称第二网络)。
在图2A中示出的是两个智能卡管理装置和两个终端，本实施例不对其限定，根据实际需要进行配置，例如，代理模块连接多个智能卡管理装置和多个终端。
在本实施例中，所述代理模块为一个，所述代理模块和业务服务中心均位于IDC机房或云端，其中代理模块和业务服务中心共用一个公网地址，如IPv4/IPv6地址，此时，对外可呈现的是IDC机房中的一个设备，可理解为代理模块从现有的业务服务模块中剥离出来的一个逻辑块，可与业务服务中心同属一台设备不同服务等。
本实施例中的智能卡管理装置可实现分布式部署即灵活部署在终端所在的区域，即智能卡管理装置与终端尽量同属一个国家或地区或同一个电信运营商网络。相对于图1所示的现有技术方案，智能卡管理装置“搬离”机房；尽可能地“靠近”终端，实现智能卡管理装置的灵活部署，可以优化智能卡管理装置和终端之间的网络路由。
在本实施例中，“搬离”机房的每一个智能卡管理装置预先配置有公网地址，如IP地址，即位于终端所在区域的每一个智能卡管理装置具有预先配置的公网地址。
本实施例的智能卡管理装置可实现为终端的鉴权处理，以实现终端接入该终端所属地的第二网络。
可理解的是，业务服务中心和代理模块对外呈现可为一个业务 服务模块，图2A和图2B中智能卡管理装置和终端与业务服务模块的交互与现有技术的交互基本相同，参照现有技术中的①至⑥的过程，实现对终端的鉴权，本实施例该处不再详述。
为更好的理解本发明实施例中提及的终端的鉴权，以下结合现有的鉴权进行说明。
通常，终端接入运营商网络时，运营商网络需要对终端进行鉴权认证。在常规的手机设备上，智能卡(即SIM卡)安装在手机上，经过终端内部的处理，鉴权请求会传输给SIM卡进行运算。SIM卡中预设了相关的算法与密钥，因此可以实现运营商网络对手机设备的认证过程，进而手机通过内部的智能卡实现连接运营商网络。
在本申请的智能卡管理装置的技术领域中，SIM卡是安装在智能卡管理装置上。终端处于漫游场景中时，终端想要连接该终端所在地的运营商网络时，因此，来自该终端所在地的运营商网络的鉴权请求会通过第一网络传输给智能卡管理装置，最终在智能卡管理装置上完成这个过程，并返回给终端，以使得终端借助于智能卡管理装置中的SIM卡连接终端所在地的第二网络。
应说明的是，第一网络可为漫游之前终端归属地的运营商网络，第二网络为终端在漫游之后终端所在地的运营商网络，终端要连接第二网络，可基于第一网络与智能卡管理装置通信，完成第二网络的接入。
实施例二
另外，由于在实施例一种智能卡管理装置的数量过多时，当前互联网环境中可用的公网IP地址比较少，为此，为每一个智能卡管理装置分配一个长久使用的公网IP地址不太现实，本实施例提供另外一种分布式管理***，如图3A、图3B和图3C所示。将位于IDC机房中代理模块搬出，并进行分布式部署，且为搬出IDC机房的每一个代理模块预先配置公网IP地址，由于一个代理模块可以连接多 个智能卡管理装置，将多个智能卡管理装置配置内网地址，由此可以减少配置在智能卡管理装置的公网IP地址，还可以实现智能卡管理装置的灵活部署，同时优化智能卡管理装置与终端之间的网络路由，并有效降低运营成本。
如图3A至图3C所示，本实施例提供另一种智能卡管理装置的分布式管理***的架构图，本实施例分布式管理***包括：属于服务中心的业务服务装置、多个智能卡管理装置、多个终端。
本实施例中的业务服务装置包括业务服务中心和两个以上的代理模块，所述每一个终端和智能卡管理模块在业务服务中心注册之后，通过业务服务中心分配的代理模块实现智能卡管理装置对终端的鉴权处理，以使所述终端接入该终端所在地的网络即第二网络。
在代理模块为多个时，业务服务中心位于IDC机房中，所述代理模块根据终端所在区域进行分布式部署，且每一代理模块具有预先配置的公网IP地址。
在具体实现过程中，假设代理模块属于部署在欧洲区域的节点(称为欧洲节点)，此时，连接欧洲节点的每一个智能卡管理装置部署在欧洲区域的各个局域网中即具有内网的IP地址，进而具有公网IP地址的代理模块便于将终端和智能卡管理装置的数据进行转发或交换，实现智能卡管理装置与终端之间的P2P(点对点/端到端)通信。可理解的是，本实施例中的公网地址即为公网IP地址，为了更好的说明，在部分描述中使用公网地址，部分描述中使用公网IP地址。
如图3C所示，假定在全球范围内提供四个节点的部署，如设置四个代理模块，该四个代理模块可包括：作为亚太节点的代理模块(设置在亚太区域)、作为拉美节点的代理模块(设置在拉美区域)、作为日韩节点的代理模块(设置在日韩区域)和作为欧洲节点的代理模块(设置在欧洲区域)。本实施例不对代理模块的数量进行限定， 可根据实际需要设置代理模块的数量及部署的区域。
在图3C中，连接业务服务中心的所有代理模块构成星形拓扑结构，任意两个代理模块之间互联互通。业务服务中心可以是一个全球多节点部署的服务平台，在本实施例中，业务服务中心可位于一个服务提供商的云端或混合云中。
全球各节点的代理模块启动后需要连接至业务服务中心(即下述的代理模块的注册过程)，这样服务中心便可以清楚地了解各个代理模块的位置及活动状态。进一步地，业务服务中心动态地给每个代理模块更新其他代理模块的位置，令其相互了解彼此的存在。
在商用环境中，通常都会有很多个智能卡管理装置，而智能卡管理装置需要尽能的“靠近”终端，在非完全锥形NAT网络环境下，智能卡管理装置与终端通信需要依赖代理模块完成，因此代理模块也有必要进行分布式部署。
由此，上述的分布式管理***实现了将智能卡管理装置“搬离”IDC机房的操作，为其分布式部署提供现实条件。在一些实施例中，智能卡管理装置还可以放在用户家里甚至可以随身携带。
实施例三
为了更好的理解增加代理模块的网元后的分布式管理***的通信过程，以下结合图4A至图7进行说明，图4A和图4B示出了两种整体交互过程的信令图，图5示出了业务服务中心作为执行主体的流程图，图6示出了代理模块作为执行主体的流程图，图7示出的代理模块作为中继器的部分流程图。
可说明的是，在分布式管理***中各网元的初始化过程中，智能卡管理装置、终端分别与业务服务中心之间初始注册的过程与现有方案基本相同，而智能卡管理装置与终端之间交互的过程则通过代理模块完成。
在本实施例中，代理模块可依据智能卡管理装置与终端所处的网络环境，可选择实现两种功能中的一种：一、中继器(代理服务器)；二、P2P连接交换器。
也就是说，在非完全锥形NAT的网络环境下终端访问智能卡管理装置需要通过代理模块，此时的代理模块可实现的是中继器的功能；
在完全锥形NAT网络环境下代理模块可将智能卡控制装置与终端的地址进行交换，之后智能卡管理装置与终端进行直接交互，即代理模块实现了P2P连接交换器的功能。
由此，上述的代理模块实现了智能卡管理装置与终端之间的P2P通信。
如图4A和图5所示，本实施例的管理方法的执行主体为业务服务中心，该管理方法可包括：
A1、业务服务中心接收每一智能卡管理装置上报的智能卡信息和该智能卡管理装置的位置信息。
举例来说，智能卡信息可包括：智能卡的IMSI、ICCID等其他卡内文件信息；智能卡在智能卡管理装置上的编号；智能卡管理装置的序列号，网络地址等。
该智能卡管理装置的位置信息可为网络地址信息。
A2、业务服务中心接收每一代理模块发送的注册请求，所述注册请求可包括发送注册信息的代理模块标识和位置信息。
在本实施例中，注册请求可包括：代理模块的序列号和校验码等信息。代理模块的位置信息主要是网络地址信息(即公网入口)，本实施例中可根据网络地址信息确定预先配置的其他信息。
A3、业务服务中心根据代理模块的位置信息、智能卡管理装置的位置信息，向各代理模块返回该代理模块用于服务的智能卡管理 装置的信息，以使各代理模块根据智能卡管理装置的信息开启接入服务。
可理解的是，业务服务中心会根据预先配置的代理模块分配策略进行分配。
A4、业务服务中心在接收代理模块返回的接入服务开启的信息后，向各智能卡管理装置推送用于服务的代理模块的地址信息(如具有公网IP的网络地址信息)，以使所述智能卡管理装置在对应的代理模块中注册。
A5、业务服务中心接收所述代理模块反馈的代理模块服务的所有智能卡管理装置的接入服务入口信息及接入状态。
通常的接入状态可为正常状态和非正常状态等。该接入服务入口信息可为用于终端可识别接入的具有公网入口的IP地址、接入端口等信息。
A6、业务服务中心接收终端发送的用于申请智能卡资源的申请请求，所述申请请求包括：终端的位置信息。
举例来说，终端的位置信息可为该终端当前所在的地理位置，如经纬度信息等。
通常，申请请求还可包括：终端所在地的运营商网络信息等。
A7、业务服务中心根据位置信息分配智能卡管理装置的接入服务入口信息及代理模块的网络地址信息；以使终端接入代理模块之后与智能卡管理装置交互，接入第二网络。
在实际应用中，业务服务中心接收代理模块的注册和智能卡管理装置的注册其不区分先后顺序，先接收智能卡管理装置的注册，或者先接收代理模块的注册均可，在图4A和图4B中示出的均是智能卡管理装置先向业务服务中心注册的过程均为举例说明。
如图4B和图6所示，本实施例的管理方法的执行主体为代理模 块，该管理方法可包括：
S1、代理模块向业务服务中心注册，并获取该代理模块用于服务的智能卡管理装置的信息，以及与用于服务的智能卡管理装置交互，获取智能卡管理装置用于服务终端的接入服务入口信息，并将接入服务入口信息发送业务服务中心。
在具体应用中，该步骤S1可包括下述的子步骤：
S11、所述代理模块向业务服务中心发送注册请求，所述注册请求包括该代理模块的标识和位置信息；
S12、所述代理模块接收所述业务服务中心反馈的注册响应及该代理模块用于服务的智能卡管理装置的信息，并根据智能卡管理装置的信息开启接入服务。
S13、所述代理模块接收智能卡管理装置发起的接入注册消息，所述接入注册消息为该智能卡管理装置根据业务服务中心推送的所述代理模块的地址信息发送的消息。
在具体应用中，智能卡管理装置还可在接入注册消息中携带该智能卡管理装置的网络环境状态信息。
通常，接入注册消息可包括：该智能卡管理装置内的智能卡信息及其序列号等信息。
S14、所述代理模块根据所述接入注册消息反馈注册状态信息，建立与智能卡管理装置的连接，并向所述业务服务中心同步所述智能卡管理装置的接入状态及用于服务终端的接入服务入口信息。
本实施例中的接入服务入口信息及包括具有公网入口的IP信息、端口的信息等。
S2、代理模块接收终端发送的用于向智能卡管理装置进行鉴权的鉴权请求，所述鉴权请求为终端接收业务服务中心分配的接入服务入口信息和代理模块的地址信息后发送的，该鉴权请求包括，业务服务中心确定的与终端配对的智能卡信息。
在一种可选的实现方式中，终端还可向代理模块发送的是连接请求，该连接请求中携带用于进行鉴权的信息，以及携带终端所处的网络环境状态信息。
或者，上述的鉴权请求中携带鉴权的信息和终端所处的网络环境状态信息。
终端或智能卡管理装置可通过STUN(Simple Traversal of UDP over NATs，NAT的UDP简单穿越)协议实现对自身网络环境的检测。
S3、代理模块依据智能卡信息查找所属的智能卡管理装置，以使所述智能卡管理装置对所述鉴权请求进行处理，使得所述终端接入第二网络。
在实际应用中，代理模块可根据图4A中框线所示的流程实现智能卡管理装置和终端之间的通信，或者，代理模块可根据图4B中框线所示的流程实现智能卡管理装置与终端之间的通信。
举例来说，所述S3可包括：
S31、所述代理模块根据预先获取的所述智能卡管理装置与所述终端所处的网络环境，判断所述智能卡管理装置和所述终端是否均处于完全锥形的NAT网络环境。
说明的是，完全锥形(Full Cone NAT)是NAT网络的一种情形。P2P通信是指点对点、端对端的通信。在完全锥形环境下的两个终端设备可以直接连接通信，对于不是在这种网络环境下的设备可以通过中间代理的模式实现通信，在本实施例中也成为P2P通信。
S32、若是，则将智能卡管理装置的地址信息发送所述终端，将所述终端的地址信息发送所述智能卡管理装置，以使所述终端和所述智能卡管理装置进行P2P通信，以对终端进行鉴权处理；如图7所示；
S33、在智能卡管理装置和终端中存在一个不处于完全锥形的 NAT网络环境中时，所述代理模块将所述鉴权请求转发查找到的智能卡管理装置；
S34、所述代理模块接收所述智能卡管理装置对鉴权请求的处理结果，并将处理结果发送所述终端，以使所述终端接入第二网络；
可理解的是，智能卡管理装置的网络环境为所述智能卡管理装置发起接入注册消息时携带的信息；
所述终端的网络环境为所述终端发起鉴权请求时携带的信息。
进一步地，上述图4A至图6任一所示的方法可包括下述的图中未示出的步骤：
S4、代理模块周期性向业务服务中心发送包括该代理模块状态的心跳信息；
S5、代理模块接收到非代理模块所属区域的终端发送的连接请求时，所述代理模块根据所述连接请求，向业务服务中心发送该终端所属区域的代理模块发生故障的信息。
如图3C和图8所示，每个代理模块都与服务中心进行连接，每个代理模块也会其他三个代理模块进行连接，这样所有的代理模块就形成一个网状拓扑构，而业务服务中心与代理模块间则是星形拓扑结构。因此，当代理模块中的某一个节点发生故障时，一方面除了业务服务中心与其他代理模块间可以及时地感知到故障并迅速动态地支撑故障节点的相应业务，而使用终端的用户无感知地平滑过渡故障外，另一方面也可以多方地向运维人员告警提示风险并加以恢复。
假设欧洲节点的代理模块发生了故障。此时，可以从三方面(即终端、业务服务中心、其他代理模块)得知此异常情况。
由于图2A和图2B所示的架构上智能卡管理装置也与服务中心进行连接，则有四个方面(即终端、业务服务中心、其他代理模块、智能卡管理装置)可以得知“欧洲节点”发生异常的事实。因此， 任一个代理模块故障的误报率是非常低的。
在具体实现过程中，每一终端上可预置有所有代理模块的位置信息(即公网IP地址信息)，当其默认代理模块不可用时，依次切换其他节点；
当智能卡管理装置与终端均预置了所有代理模块的公网IP地址信息时，智能卡管理装置启动后会与所有代理模块进行连接。当某一代理模块发生故障时，终端可以自己触发转接至其他代理模块，而智能卡管理装置本身已与其他所有代理模块有连接，因此只要终端连接上其他代理模块之后，便可以与其最为邻近的智能卡管理装置进行通信。
另一种可能的实现方式是，终端在连接故障的代理模块时，可将代理模块异常情况通报给业务服务中心，由业务服务中心调配信息，进而实现动态路由。
以图8为例，假如“欧洲节点”发生故障后，此欧洲节点与外部的所有连接均被中断(在图8中采用虚线表示故障的“欧洲节点”，同时采用虚线表示中断的所有连接)。此时业务服务中心可以检查到异常(如业务服务中心根据各代理模块反馈的心跳信息检查是否异常)，其他网元(智能卡管理装置、终端、其他正常代理模块)也会告警此事件。此时便可以通知运维人员进行问题排查。
与此同时，当终端检测到其无法连接上其默认的“欧洲节点”代理模块时，其根据预置的代理模块的信息将服务请求发往“亚太节点”。由于“亚太节点”先前已经与欧洲节点正常连接并交换了信息，并且智能卡管理装置同样与其有连接。此时“亚太节点”代理模块直接将终端的服务请求转发至智能卡管理装置即可。
在具体实现中，可以提前在智能卡管理装置及终端预置所有代理模块位置信息，并将所有代理模块互连。
在实际应用中，本实施例提供以下的连接策略：
1)每个代理模块仅与最多8个其他代理模块相连；
2)每个智能卡管理装置及终端仅与两个代理模块相连。
这样有效降低整体分布式管理***的网络复杂度。
在本实施例中，分布式部署的代理模块可实现互联互通，当部分代理模块出现故障时，网络内的其他正常代理模块节点可迅速成为故障节点灾备节点，继续为终端提供服务，从而可以实现为终端提供持续服务，还可以优化服务质量。
本实施例中的终端还用于会记录每一次鉴权请求所消耗的时间、鉴权时间、终端地址位置、所使用的代理模块等信息，周期性对记录的信息上传给业务服务中心，业务服务中心根据终端周期性上传的信息可对代理模块进行综合评价。
本发明实施例的分布式管理***除了节点故障外，对于优化***服务质量，动态地调节终端与代理模块的绑定关系，从而实现动态路由，最优化服务质量。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的实施例中，应该理解到，方法实施例的步骤之间除非存在明确的先后顺序，否则执行顺序可任意调整。所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻 辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。
虽然结合附图描述了本发明的实施方式，但是本领域技术人员可以在不脱离本发明的精神和范围的情况下做出各种修改和变型，这样的修改和变型均落入由所附权利要求所限定的范围之内。

Claims (10)

  1. 一种智能卡管理装置的分布式管理***，其特征在于，包括：
    属于服务中心的业务服务装置、多个智能卡管理装置、多个终端；
    所述业务服务装置包括业务服务中心和至少一个代理模块，每一个终端和智能卡管理模块在业务服务中心注册之后，通过业务服务中心分配的代理模块实现智能卡管理装置对终端的鉴权处理，以使所述终端接入该终端所在地的网络；
    其中，为终端进行鉴权处理的智能卡管理装置位于终端所在的区域，且每一代理模块连接多个分布式部署的智能卡管理装置。
  2. 根据权利要求1所述的分布式管理***，其特征在于：
    所述代理模块为一个时，所述代理模块和业务服务中心均位于IDC机房中共用一个公网地址，位于终端所在区域的每一个智能卡管理装置具有预先配置的公网地址。
  3. 根据权利要求1所述的分布式管理***，其特征在于：
    在代理模块为多个时，所述业务服务中心位于IDC机房或云端，所述代理模块根据终端所在区域进行分布式部署，且每一代理模块具有预先配置的公网地址；
    每一代理模块连接的每一个智能卡管理装置配置有内网地址，且该代理模块实现为终端进行鉴权处理的智能卡管理装置与该终端进行点对点通信。
  4. 根据权利要求3所述的分布式管理***，其特征在于：
    所述代理模块还用于转发所述智能卡管理装置与业务服务中心之间的交互数据；
    连接业务服务中心的所有代理模块构成星形拓扑结构，任意两个代理模块之间互联互通，和/或，业务服务中心位于服务提供商的云端或混合云中。
  5. 一种分布式管理***的管理方法，其特征在于，所述分布式管理***包括：连接业务服务中心的分布式部署的多个具有公网地址的代理模块，每一代理模块连接多个配置有内网地址的智能卡管理装置，多个用于接入所在地网络的终端，所述管理方法包括：
    S1、所述代理模块向业务服务中心注册，并获取该代理模块用于服务的智能卡管理装置的信息，以及与用于服务的智能卡管理装置交互，获取智能卡管理装置用于服务终端的接入服务入口信息，并将接入服务入口信息发送业务服务中心；
    S2、所述代理模块接收终端发送的用于向智能卡管理装置进行鉴权的鉴权请求，所述鉴权请求为终端接收业务服务中心分配的接入服务入口信息和代理模块的地址信息后发送的，该鉴权请求包括，业务服务中心确定的与终端配对的智能卡信息；
    S3、所述代理模块依据智能卡信息查找所属的智能卡管理装置，以使所述智能卡管理装置对所述鉴权请求进行处理，使得所述终端接入该终端所在地的网络。
  6. 根据权利要求5所述的管理方法，其特征在于，S1包括：
    所述代理模块向业务服务中心发送注册请求，所述注册请求包括该代理模块的标识和位置信息；
    所述代理模块接收所述业务服务中心反馈的注册响应及该代理模块用于服务的智能卡管理装置的信息，并根据智能卡管理装置的信息开启接入服务；
    所述代理模块接收智能卡管理装置发起的接入注册消息，所述接入注册消息为该智能卡管理装置根据业务服务中心推送的所述代理模块的地址信息发送的消息；
    所述代理模块根据所述接入注册消息反馈注册状态信息，建立与智能卡管理装置的连接，并向所述业务服务中心同步所述智能卡管理装置的接入状态及用于服务终端的接入服务入口信息。
  7. 根据权利要求6所述的管理方法，其特征在于，所述S3包括：
    所述代理模块根据预先获取的所述智能卡管理装置与所述终端所处的网络环境，判断所述智能卡管理装置和所述终端是否均处于完全锥形的NAT网络环境；
    若是，则将智能卡管理装置的地址信息发送所述终端，将所述终端的地址信息发送所述智能卡管理装置，以使所述终端和所述智能卡管理装置进行直接通信，以对终端进行鉴权处理；
    否则，所述代理模块将所述鉴权请求转发查找到的智能卡管理装置；
    所述代理模块接收所述智能卡管理装置对鉴权请求的处理结果，并将处理结果发送所述终端，以使所述终端接入所述网络；
    其中，智能卡管理装置的网络环境为所述智能卡管理装置发起接入注册消息时携带的信息；
    所述终端的网络环境为所述终端发起鉴权请求时携带的信息。
  8. 根据权利要求6所述的管理方法，其特征在于，所述方法还包括：
    所述代理模块周期性向业务服务中心发送包括该代理模块状态的心跳信息；
    和/或，
    所述代理模块接收到非代理模块所属区域的终端发送的连接请求时，所述代理模块根据所述连接请求，向业务服务中心发送该终端所属区域的代理模块发生故障的信息。
  9. 一种分布式管理***的管理方法，其特征在于，所述分布式管理***包括：连接业务服务中心的分布式部署的多个具有公网地址的代理模块，每一代理模块连接多个配置有内网地址的智能卡管理装置，多个用于接入所在地网络的终端，所述管理方法包括：
    A1、业务服务中心接收每一智能卡管理装置上报的智能卡信息和该智能卡管理装置的位置信息；
    A2、业务服务中心接收每一代理模块发送的注册请求，所述注册请求包括发送注册信息的代理模块的标识和位置信息；
    A3、所述业务服务中心根据代理模块的位置信息、智能卡管理装置的位置信息，向各代理模块返回该代理模块用于服务的智能卡管理装置的信息，以使各代理模块根据智能卡管理装置的信息开启接入服务；
    A4、所述业务服务中心在接收代理模块返回的接入服务开启的信息后，向各智能卡管理装置推送用于服务的代理模块的地址信息，以使所述智能卡管理装置在对应的代理模块中注册；
    A5、所述业务服务中心接收所述代理模块反馈的代理模块服务的所有智能卡管理装置的接入服务入口信息及接入状态；
    A6、所述业务服务中心接收终端发送的用于申请智能卡资源的申请请求，所述申请请求包括：终端的位置信息和终端所在地的运营商网络信息；
    A7、所述业务服务中心根据申请请求分配智能卡管理装置的接入服务入口信息及代理模块的地址信息；以使终端接入代理模块之后与其连接的智能卡管理装置交互，接入终端所在地的网络。
  10. 根据权利要求9所述的管理方法，其特征在于，所述方法还包括：
    所述业务服务中心根据互联互通策略，向注册的代理模块发送第一预设数量的相邻代理模块的地址信息，以使所述代理模块与相邻的代理模块连通；
    和/或，
    所述业务服务中心根据互联互通策略，向注册的智能卡管理装置或终端发送第二预设数量的代理模块的地址信息及优先级信息， 以使智能卡管理装置或终端存储第二预设数量的代理模块的地址信息，并根据优先级信息选择一个代理模块连接。
PCT/CN2021/123685 2020-10-22 2021-10-14 一种智能卡管理装置的分布式管理***及管理方法 WO2022083492A2 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21881910.0A EP4216588A4 (en) 2020-10-22 2021-10-14 DISTRIBUTED MANAGEMENT SYSTEM AND MANAGEMENT METHOD FOR SMART CARD MANAGEMENT DEVICES
JP2023524195A JP7480434B2 (ja) 2020-10-22 2021-10-14 スマートカード管理装置の分散管理システム及び管理方法

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011135399.6 2020-10-22
CN202011135399.6A CN112019573B (zh) 2020-10-22 2020-10-22 一种智能卡管理装置的分布式管理***及管理方法

Publications (2)

Publication Number Publication Date
WO2022083492A2 true WO2022083492A2 (zh) 2022-04-28
WO2022083492A3 WO2022083492A3 (zh) 2022-06-02

Family

ID=73528130

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/123685 WO2022083492A2 (zh) 2020-10-22 2021-10-14 一种智能卡管理装置的分布式管理***及管理方法

Country Status (4)

Country Link
EP (1) EP4216588A4 (zh)
JP (1) JP7480434B2 (zh)
CN (1) CN112019573B (zh)
WO (1) WO2022083492A2 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112019573B (zh) * 2020-10-22 2021-01-12 上海途鸽数据科技有限公司 一种智能卡管理装置的分布式管理***及管理方法

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104144402B (zh) 2013-05-08 2019-01-18 华为技术有限公司 实现移动终端本地化漫游的方法及相关装置
CN103312809A (zh) * 2013-06-24 2013-09-18 北京汉柏科技有限公司 云平台中服务的分布式管理方法
EP2824945A1 (en) * 2013-07-11 2015-01-14 Alcatel Lucent Sim proxy module for roaming in a mobile network
CN104394522A (zh) * 2014-10-30 2015-03-04 北京神州泰岳软件股份有限公司 一种通信链路的建立方法及装置
CN104378752B (zh) 2014-06-30 2019-04-02 天津泰岳小漫科技有限公司 一种网络漫游***及网络漫游方法
CN105813072B (zh) * 2014-12-29 2019-10-18 ***通信集团公司 一种终端鉴权方法、***及云端服务器
CN105554728A (zh) * 2015-12-10 2016-05-04 深圳市迪讯飞科技有限公司 一种云端sim卡池***
CN105812370B (zh) * 2016-03-16 2019-02-15 中国联合网络通信集团有限公司 智能卡处理方法、装置及***
CN107404509B (zh) * 2016-05-20 2020-06-26 北京融聚世界网络科技有限公司 分布式服务配置***及信息管理方法
CN105848152B (zh) * 2016-05-30 2019-05-21 深圳优克云联科技有限公司 一种网络接入方法、装置及***
US10425465B1 (en) * 2016-07-29 2019-09-24 Google Llc Hybrid cloud API management
CN112019573B (zh) * 2020-10-22 2021-01-12 上海途鸽数据科技有限公司 一种智能卡管理装置的分布式管理***及管理方法
CN112134744B (zh) * 2020-10-23 2023-04-18 上海途鸽数据科技有限公司 一种分布式管理***中节点的管理方法

Also Published As

Publication number Publication date
JP2023543323A (ja) 2023-10-13
WO2022083492A3 (zh) 2022-06-02
CN112019573A (zh) 2020-12-01
CN112019573B (zh) 2021-01-12
EP4216588A4 (en) 2024-02-28
EP4216588A2 (en) 2023-07-26
JP7480434B2 (ja) 2024-05-09

Similar Documents

Publication Publication Date Title
US11902086B2 (en) Method and system of a dynamic high-availability mode based on current wide area network connectivity
US8767737B2 (en) Data center network system and packet forwarding method thereof
TW200845609A (en) Redundant wireless base station
JP2019506053A (ja) サブネットワークを有する通信ネットワークにおける通信のための通信システム
US10201033B2 (en) Method and system for managing network traffic
CN106713039B (zh) 以太网口的识别方法、装置及路由器
CN112333713B (zh) 5g自组网***、自组网方法、计算机设备及存储介质
WO2011091696A1 (zh) 相邻基站连接的建立方法、建立设备和建立***
WO2016197544A1 (zh) 网络连接处理方法及装置
US12021699B2 (en) Software defined access fabric without subnet restriction to a virtual network
WO2018135428A1 (ja) ゲートウェイ装置、ネットワークアドレス変換装置、通信システム、通信方法、および、プログラム
WO2020057445A1 (zh) 一种通信***、方法及装置
EP2218214B1 (en) Network location service
EP3583751B1 (en) Method for an improved deployment and use of network nodes of a switching fabric of a data center or within a central office point of delivery of a broadband access network of a telecommunications network
CN113381936B (zh) 网络信息处理方法、装置及网络设备
WO2022083492A2 (zh) 一种智能卡管理装置的分布式管理***及管理方法
CN112134744B (zh) 一种分布式管理***中节点的管理方法
CN102447703B (zh) 一种热备份方法和***、cgn设备
WO2020181733A1 (zh) 一种基于vpc的多数据中心互通方法及相关设备
CN115333819A (zh) 一种远程网络访问***及通信方法
CN114025010A (zh) 建立连接的方法和网络设备
CN106878051B (zh) 一种多机备份实现方法及装置
CN104660446A (zh) N:1保护场景下dhcp中继实现***及方法
US20030002647A1 (en) Computer telephony (CT) network serving multiple telephone switches
CN117459307A (zh) 一种基于服务代理的工作流跨网协同方法

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2023524195

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 2021881910

Country of ref document: EP

Effective date: 20230419

NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21881910

Country of ref document: EP

Kind code of ref document: A2