CN106330479A - A device operation and maintenance method and system - Google Patents

Abstract

The invention discloses an equipment operation and maintenance method. The method comprises steps: a built-in proxy server for a user access portal and a proxy gateway as a gateway of a local area network device build a control channel for transmitting a control signaling between the two; the proxy server and the proxy gateway for the local area network device with login requested build a data channel by using the queried control channel; and the user access portal sends received operation data on the local area network device by the user to the queried proxy gateway for the local area network device e with login requested via the data channel through the proxy server. The security is improved, program mounting on each piece of equipment can be avoided, and the operation is thus simplified.

Description

A device operation and maintenance method and system

technical field

The invention relates to the field of operation and maintenance of network management equipment. In particular, a safe and fast operation and maintenance method and system.

Background technique

Since the current network environment of LAN devices is generally an intranet address and cannot be directly accessed externally, in order to ensure that the operation and maintenance personnel can log in and repair the faulty equipment in this environment, the operation and maintenance personnel need to open ports on the equipment. It is necessary to jump step by step through the jumper and log in to the target device through the open port, which undoubtedly increases the complexity of the operation and maintenance work and inefficiency; and once the port is opened on the device, there will be security risks, which is equivalent to leaving With the back door, there is no guarantee that there will be no cyber attacks, which also leads to the inability to guarantee the security of operation and maintenance work.

Or it is necessary to install an agent program on the device, but it involves installing software on the device, especially in the case of a huge number of devices in a local area network, the process is cumbersome.

Contents of the invention

In order to solve the above problems, the present invention provides a method and device for equipment operation and maintenance, which can improve the safety of equipment operation and maintenance, improve the efficiency of management, and be simple and convenient.

A device operation and maintenance method, the method comprising:

The built-in proxy server of the user access portal and the proxy gateway as the gateway of the LAN device establish a control channel for transmitting control signaling between each other;

The user access portal receives a request from a user to operate a LAN device;

The user access portal queries the proxy gateway of the LAN device that requests login, and the control channel established between the proxy gateway and the proxy server;

The proxy server and the proxy gateway of the LAN device requesting to log in use the queried control channel to establish a data channel;

The user access portal sends the received user operation data on the LAN device through the proxy server to the proxy gateway of the queried LAN device requesting login through the data channel;

The queried proxy gateway of the LAN device requesting to log in sends the operation data to the LAN device that the user requests to operate.

Optionally, wherein the proxy server and the proxy gateway establish a control channel for transmitting control signaling, including:

The proxy gateway sends an inquiry message to the user access portal;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server;

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Optionally, the proxy server and the proxy gateway of the LAN device requesting to log in use the queried control channel to establish a data channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the LAN device requesting to log in through the control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server receives the request message;

The proxy server and the proxy gateway of the found LAN device requesting to log in establish a data channel between them.

Optionally, the queried proxy gateway of the LAN device requesting to log in sends the operation data to the LAN device that the user requests to operate, including:

The proxy gateway receives the data packet sent by the proxy server;

The proxy gateway forwards the data packet to the LAN device that the user requests to operate.

A device operation and maintenance system, the system comprising: a user access portal of a local area network device, and a proxy gateway serving as a gateway of the local area network device, wherein,

The user access portal is used to establish a control channel for transmitting control signaling through the built-in proxy server and the proxy gateway;

Receive the user's request to operate the LAN device;

Query the proxy gateway of the LAN device requesting to log in, and the control channel established between the proxy gateway and the proxy server;

Establishing a data channel by utilizing the queried control channel with the proxy gateway of the queried LAN device requesting login;

Sending the received operation data of the user to the LAN device through the proxy server via the data channel to the proxy gateway of the queried LAN device requesting to log in;

The proxy gateway is configured to establish a control channel for transmitting control signaling with the user access portal through a proxy server in the user access portal;

The queried proxy gateway of the LAN device that requests to log in is used to send the operation data to the LAN device that the user requests to operate.

Optionally,

The user access portal is used to establish a control channel for transmitting control signaling through the built-in proxy server and the proxy gateway, including:

The user accesses the portal to receive the inquiry message sent by the proxy gateway;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server,

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Optionally,

The user access portal and the proxy gateway of the queried LAN device requesting to log in use the queried control channel to establish a data channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the queried LAN device through the queried control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server and the proxy gateway of the LAN device requesting to log in establish a data channel between them.

Optionally,

The queried proxy gateway of the LAN device requesting to log in is used to send the operation data to the LAN device that the user requests to operate, including:

The proxy gateway receives the data packet sent by the proxy server;

The proxy gateway forwards the data packet to the LAN device that the user requests to operate.

A user access portal for LAN devices,

The user access portal includes a proxy module, a receiving module, a query module, and the proxy module includes a plurality of proxy servers;

The proxy server establishes a control channel for transmitting control signaling with a proxy gateway serving as a gateway of a LAN device;

The user access portal, including:

A receiving module, configured to receive a request from a user to operate a LAN device, and send the user's operation data on the LAN device to the proxy server;

A query module, configured to query the proxy gateway of the LAN device requesting login, and the control channel established between the proxy gateway and the proxy server;

The proxy module is used to establish a data channel through the proxy server and the proxy gateway of the LAN device requesting to log in using the queried control channel; through the proxy server, the received user operation data on the LAN device is passed through the proxy server. The above data channel is sent to the queried proxy gateway.

Optionally,

The proxy server establishes a control channel for transmitting control signaling with the proxy gateway as the gateway of the LAN device, including:

The proxy gateway sends an inquiry message to the user access portal;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server;

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Optionally,

The proxy module is used to establish a data channel through the proxy server and the proxy gateway of the LAN device requesting to log in using the queried control channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the LAN device requesting to log in through the control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server receives the request message;

The proxy server and the proxy gateway of the found LAN device requesting to log in establish a data channel between them.

By adopting the method and device of the present invention, the problems of low security or cumbersome programs and low efficiency caused by installing programs for local area network equipment in the prior art are solved.

The operation of the proxy server to the LAN is sent through a dedicated data channel, thereby improving security. It not only improves the security of equipment operation and maintenance, but also does not need to modify the program of the LAN equipment, simplifies the operation, and improves the management efficiency.

Description of drawings

Fig. 1 is a flow chart of the present invention;

Fig. 2 is a system networking structure diagram provided by the present invention;

Fig. 3 is the Agent and Portal registration timing diagram that the present invention provides;

Fig. 4 is the sequence diagram of establishing the Agent control channel provided by the present invention;

Fig. 5 is that the user provided by the present invention logs in to managed device sequence diagram through portal SSH (Secure Shell);

Fig. 6 is a schematic diagram of reverse proxy technology.

detailed description

The technical solution of the present invention will be described in more detail below with reference to the drawings and embodiments.

It should be noted that, if there is no conflict, the embodiments of the present invention and various features in the embodiments can be combined with each other, and all are within the protection scope of the present invention. In addition, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

A device operation and maintenance method, the method comprising:

The built-in proxy server of the user access portal and the proxy gateway as the gateway of the LAN device establish a control channel for transmitting control signaling between each other;

The user access portal receives a request from a user to operate a LAN device;

The user access portal queries the proxy gateway of the LAN device that requests login, and the control channel established between the proxy gateway and the proxy server;

The proxy server and the proxy gateway of the LAN device requesting to log in use the queried control channel to establish a data channel;

The user access portal sends the received user operation data on the LAN device through the proxy server to the proxy gateway of the queried LAN device requesting login through the data channel;

The queried proxy gateway of the LAN device requesting to log in sends the operation data to the LAN device that the user requests to operate.

Fig. 1 is a flow chart of the present invention:

Step S101: the user accesses the built-in proxy server of the portal, and the proxy gateway as the gateway of the LAN device establishes a control channel for transmitting control signaling between each other;

Step S102: the user access portal receives a user's request to operate a LAN device;

Step S103: the user accesses the portal to query the proxy gateway of the LAN device that requests to log in, and the control channel established between the proxy gateway and the proxy server;

Step S104: The proxy server establishes a data channel with the proxy gateway of the LAN device requesting to log in using the queried control channel;

Step S105: The user access portal sends the received user operation data on the LAN device to the queried proxy gateway through the proxy server via the data channel;

Step S106: The queried proxy gateway sends the operation data to the LAN device requested by the user for operation.

In Figure 1, Portal is the user access portal, and Agent is the proxy gateway.

Communication between Agent and Portal provided by the present invention is based on standard SSL (Secure SocketLayer) encryption system, and the registration process is as shown in Figure 3. When Agent performs registration authentication, it needs to use certificate signature and key information encryption to send to Portal, and Portal signs After the inspection and certificate authentication are successful, the Agent can actually establish a communication channel with the Portal.

Fig. 3 is a sequence diagram of Agent and Portal registration provided by the present invention:

Step S301: judging whether the Agent matches the Portal according to the certificate;

Step S302: If the matching is successful, continue, and if it fails, stop;

Step S303: the Agent transmits relevant registration information to the Portal;

Step S304: Portal sends a message to the user, notifying the user to review;

Step S305: the user sends a message to the Portal, informing the Portal that the review is passed and the registration is successful;

Step S306: Portal sends a registration success message to Agent.

The communication process between Agent and Portal uses two communication channels: control channel and data channel. The control channel is established when the Agent starts to register. Specifically, after the registration is completed, the control channel is established. The control channel is used for the exchange of control information between the Agent and the Portal and the establishment and closing of the control data channel.

Optionally,

Optionally, wherein the proxy server and the proxy gateway establish a control channel for transmitting control signaling, including:

The proxy gateway sends an inquiry message to the user access portal;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server;

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Fig. 4 is the sequence diagram of establishing the Agent control channel provided by the present invention;

Step S401: the Agent first accesses all Agent servers of the Portal;

Step S402: Portal returns to the agent server Agent server list that Agent has opened;

Step S403: the Agent tries to establish connections with all Agentservers deployed on the Portal, and searches for the optimal one.

That is to say, for an Agent, in the Portal, it may correspond to multiple proxy servers Agentserver, by comparison, find out the proxy server with the fastest response, that is, the optimal server, and establish a connection with the optimal proxy server .

Step S404: the Agent establishes a connection with the proxy server of the Portal to form a control channel.

The Agent actually establishes a connection with the built-in proxy server Agent Server on the Portal side, and the proxy server Agent Server opens a port to handle message transfer;

The data channel is the channel through which the user uses the remote tool provided on the Portal to communicate with the accessed device through the built-in service of the Agent Server on the Portal side.

Portal and Agent will conduct a security check based on the communication certificate through the control channel. Once the check fails, Agent and Portal will automatically cut off the data channel.

Optionally, the proxy server and the proxy gateway of the LAN device requesting to log in use the queried control channel to establish a data channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the LAN device requesting to log in through the control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server receives the request message;

The proxy server and the proxy gateway of the found LAN device requesting to log in establish a data channel between them.

Optionally, the queried proxy gateway of the LAN device requesting to log in sends the operation data to the LAN device that the user requests to operate, including:

The proxy gateway receives the data packet sent by the proxy server;

The proxy gateway forwards the data packet to the LAN device that the user requests to operate.

During the entire communication process between Agent and Portal, Portal serves as a server to provide external services through a fixed port, and Agent establishes a reverse connection with Portal through TCP reverse proxy technology.

This ensures that the Agent does not open any fixed external ports, thereby preventing the Agent side from encountering network attacks.

Fig. 5 is a sequence diagram of a user logging in to a managed device through a portal SSH (Secure Shell) provided by the present invention

An application scenario for logging in to managed devices using SSH through Portal:

Below in conjunction with accompanying drawing 5 the concrete implementation method of the present invention is further described:

In step S501, the operation and maintenance personnel need to log in to a certain device A in the LAN through the SSH tool from the Portal.

In step S502, the Portal queries the database to find information about the device A, including the Agent in charge of the device A, the ID of the control channel between the Agent and the Portal, and the like.

Step S503, the Portal's built-in service Agent Server will find the control channel through the control channel ID, and send an instruction to request the Agent to actively establish a data channel with the Portal for the interaction between the SSH client and the target device. The instruction format is

type=ReqConnect&agentSrvId=2&hostIp=10.46.180.130&agentPort=8323.

In step S504, the Agent establishes a data channel to the Portal, and establishes a Socket connection according to the IP and agent port sent by the Portal.

In step S505, the Portal records the newly established data channel ID, and the user's operations on the remote device on the Portal will be forwarded to the Agent by the Portal's Agent Server through the data channel.

In step S506, after the Agent receives the data packet, it directly forwards it to the local SOCKS5 proxy service for processing. The SOCKS5 proxy service is a common standard for forwarding the data packet.

It is worth noting that the IP address information of the LAN device may be included in the data packet. After the Agent receives the data packet, it can send the data packet to the LAN device according to the IP address message.

Step S507, the SOCKS5 proxy service transmits the data packet to the LAN device A.

In step S508, the LAN device A processes the corresponding command, and then sends the response data to the SOCKS5 proxy of the Agent.

Step S509, the SOCKS5 proxy on the Agent sends the response data back to the Portal side along the original path.

In step S510, the Portal finally echoes back the response data to the user. The invention uses Agent as the gateway and the Agent itself is not open to the outside world, but communicates with the Portal based on the reverse proxy technology, and the managed device has zero intrusion. While ensuring the operation and maintenance personnel to access the device quickly and conveniently, it can also ensure the network of the managed device security.

A device operation and maintenance system, the system comprising: a user access portal of a local area network device, and a proxy gateway serving as a gateway of the local area network device, wherein,

The user access portal is used to establish a control channel for transmitting control signaling through the built-in proxy server and the proxy gateway;

Receive the user's request to operate the LAN device;

Query the proxy gateway of the LAN device requesting to log in, and the control channel established between the proxy gateway and the proxy server;

Establishing a data channel by utilizing the queried control channel with the proxy gateway of the queried LAN device requesting login;

Sending the received operation data of the user to the LAN device through the proxy server via the data channel to the proxy gateway of the queried LAN device requesting to log in;

The proxy gateway is configured to establish a control channel for transmitting control signaling with the user access portal through a proxy server in the user access portal;

The queried proxy gateway of the LAN device that requests to log in is used to send the operation data to the LAN device that the user requests to operate.

Fig. 2 is a system network structure diagram provided by the present invention.

Agent is a proxy gateway; Portal is a user access portal, or called a user access portal.

The system includes agent gateway Agent as the gateway of the LAN device and the user access portal Portal of the LAN device. The Agent is responsible for opening the message channel between the Portal and the LAN device, and is only open to the Portal. Portal provides a unified management entrance for accessing management devices. LAN identification is divided into two groups, each group has an agent gateway Agent, and a user access portal contains multiple agent servers Agent Server.

Optionally,

The user access portal is used to establish a control channel for transmitting control signaling through the built-in proxy server and the proxy gateway, including:

The user accesses the portal to receive the inquiry message sent by the proxy gateway;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server,

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Optionally,

The user access portal and the proxy gateway of the queried LAN device requesting to log in use the queried control channel to establish a data channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the queried LAN device through the queried control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server and the proxy gateway of the LAN device requesting to log in establish a data channel between them.

Optionally,

The queried proxy gateway of the LAN device requesting to log in is used to send the operation data to the LAN device that the user requests to operate, including:

The proxy gateway receives the data packet sent by the proxy server;

The proxy gateway forwards the data packet to the LAN device that the user requests to operate.

A user access portal for LAN devices,

The user access portal includes a proxy module, a receiving module, a query module, and the proxy module includes a plurality of proxy servers;

The proxy server establishes a control channel for transmitting control signaling with a proxy gateway serving as a gateway of a LAN device;

The user access portal, including:

A receiving module, configured to receive a request from a user to operate a LAN device, and send the user's operation data on the LAN device to the proxy server;

A query module, configured to query the proxy gateway of the LAN device requesting login, and the control channel established between the proxy gateway and the proxy server;

The proxy module is used to establish a data channel through the proxy server and the proxy gateway of the LAN device requesting to log in using the queried control channel; through the proxy server, the received user operation data on the LAN device is passed through the proxy server. The above data channel is sent to the queried proxy gateway.

Optionally,

The proxy server establishes a control channel for transmitting control signaling with the proxy gateway as the gateway of the LAN device, including:

The proxy gateway sends an inquiry message to the user access portal;

The user access portal sends the opened proxy server list information to the proxy gateway;

The proxy gateway sends a connection establishment request to the activated proxy server;

The activated proxy server receives the connection establishment request sent by the proxy gateway,

A control channel is established with the proxy gateway by the proxy server that establishes the fastest connection with the proxy gateway.

Optionally,

The proxy module is used to establish a data channel through the proxy server and the proxy gateway of the LAN device requesting to log in using the queried control channel, including:

The proxy server sends a command to establish a data channel to the proxy gateway of the LAN device requesting to log in through the control channel;

The proxy gateway of the LAN device requesting to log in sends a data channel establishment request message to the proxy server;

The proxy server receives the request message;

The proxy server and the proxy gateway of the found LAN device requesting to log in establish a data channel between them.

The present invention provides a solution, which is used to solve the problem of remote operation and maintenance. The operation and maintenance personnel can safely and quickly access the target device in the LAN environment in the operation environment through a simple and unified portal entry, and the target device does not need to open ports or install agent.

The invention uses Agent as the gateway, and the Agent itself is not open to the outside world, but communicates with the Portal based on the reverse proxy technology, and the managed device has zero intrusion. While ensuring that the operation and maintenance personnel can access the device quickly and conveniently, it can also ensure that the managed device network security.

About reverse proxy technology:

A common proxy is generally called a forward proxy, which is only used to proxy the connection request from the internal network to the external network, and does not support the access request from the external network to the internal network. When a proxy server can act as a proxy for hosts on the external network to access the internal network, this proxy is called a reverse proxy.

Figure 6 shows the working principle of the reverse proxy technology:

It includes a client 601, a reverse proxy server 602, and a server 603; as can be seen from the figure, a server called a reverse proxy server 602 is also set between the real server 603 and the client 601.

Setting up a reverse proxy server in front of the real server has the following effects:

The reverse proxy server is directly connected to the client, and then connected to the real server, which can reduce the load on the real server. For example, if the content accessed by the client is cached on the reverse proxy server, the proxy server can directly send the content to the client. Thereby reducing the load on the real server.

In addition, the real server is set behind the reverse proxy server, and when the client accesses, it directly collects only the information of the reverse proxy server, which protects the information and data of the real server, prevents hackers from attacking, and improves the authenticity. Server Security.

That is to say, in the present invention, the Agent is equivalent to a reverse proxy server, and the controlled device in the local area network is equivalent to a real server; the Portal is equivalent to a client.

The client is to access the controlled device in the LAN. The reason why the agent is used as the proxy is that the client and the LAN device server cannot be directly connected, so the communication data must be forwarded through the agent proxy; because the agent does not open the port for security, but The client must have a connection channel to communicate with the agent agent, so here the agent server starts port monitoring, and the agent establishes a reverse connection to form a data channel, so that the communication between the client and the real server of the LAN can be opened. Agent also becomes a reverse proxy server.

Use reverse proxy technology to achieve a unified and secure access to managed devices. Through this solution, remote access can be quickly realized with LAN devices in the operating environment.

Those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

Of course, the present invention can also have other various embodiments, and those skilled in the art can make various corresponding changes and deformations according to the present invention without departing from the spirit and essence of the present invention, but these corresponding Changes and deformations should all belong to the protection scope of the claims of the present invention.

Claims (11)

1. an equipment O&M method, it is characterised in that described method includes:

User accesses the built in agent server of door, builds as the proxy gateway of the gateway of lan device Vertical transmission each other controls the control passage of signaling；

Described user accesses door and receives the request of user operation lan device；

Described user accesses the proxy gateway of the lan device that door inquiry request logs in, and this agency The control passage that gateway is set up with described proxy server；

The proxy gateway of the lan device that described proxy server logs in described request utilizes and inquires Control passage, set up data channel；

User accesses door and passes through described by the user received to the operation data of described lan device The lan device that proxy server logs in via the request inquired described in the transmission extremely of described data channel Proxy gateway；

Described operation data are sent by the proxy gateway of the lan device that the described request inquired logs in The lan device of operation is asked to user.

2. the method for claim 1, it is characterised in that wherein, described proxy server, Described proxy gateway is set up transmission and is controlled the control passage of signaling, including:

Described proxy gateway accesses door to described user and sends inquiry message；

Described user accesses door and sends the proxy server list information having been switched on to described agency Gateway；

Described proxy gateway sends connection establishment request to the described proxy server having been switched on；

The described proxy server having been switched on receives the connection establishment request that described proxy gateway sends,

Control is set up with described proxy gateway by setting up the proxy server being connected the soonest with described proxy gateway Passage processed.

3. method as claimed in claim 1 or 2, it is characterised in that described proxy server, institute The proxy gateway stating the lan device that request logs in utilizes the control passage inquired, and sets up data and leads to Road, including:

The generation of the lan device that described proxy server is logged in described request by described control passage Reason gateway sends sets up Data Channel Command；

The proxy gateway of the lan device that described request logs in sends to described proxy server and sets up number According to channel request message；

Described proxy server receives described request message；

Described proxy server, described in find request log in lan device proxy gateway set up Data channel each other.

4. the method for claim 1, it is characterised in that described in inquire request log in The lan device of operation is asked in the transmission of described operation data by the proxy gateway of lan device to user, Including:

Described proxy gateway receives the packet that described proxy server sends；

Described packet is forwarded to described user and asks the lan device of operation by described proxy gateway.

5. an equipment operational system, it is characterised in that described system includes: the use of lan device Family accesses door, the proxy gateway of gateway as lan device, wherein,

Described user accesses door, passes for being set up by built-in proxy server and described proxy gateway The control passage of defeated control signaling；

Receive the request of user operation lan device；

The proxy gateway of lan device that inquiry request logs in, and this proxy gateway and described agency's clothes The control passage that business device is set up；

With the proxy gateway of the lan device that the described request inquired logs in, utilize the control inquired Passage, sets up data channel；

The operation data of described lan device are passed through described proxy server warp by the user received The proxy gateway of the lan device that the request inquired described in described data channel sends extremely logs in；

Described proxy gateway, for accessing door with described user, is accessed in door by described user Proxy server is set up transmission and is controlled the control passage of signaling；

The proxy gateway of the lan device that the described request inquired logs in, for by described operation data Transmission asks the lan device of operation to user.

6. system as claimed in claim 5, it is characterised in that

Described user accesses door, passes for being set up by built-in proxy server and described proxy gateway The control passage of defeated control signaling, including:

Described user accesses door and receives the inquiry message that described proxy gateway sends；

Described user accesses door and sends the proxy server list information having been switched on to described agency Gateway；

Described proxy gateway sends connection establishment request to the described proxy server having been switched on,

The described proxy server having been switched on receives the connection establishment request that described proxy gateway sends,

Control is set up with described proxy gateway by setting up the proxy server being connected the soonest with described proxy gateway Passage processed.

7. the system as described in claim 5 or 6, it is characterised in that

Described user accesses the proxy gateway of the lan device that door logs in the described request inquired, Utilize the control passage inquired, set up data channel, including:

Described proxy server pass through described in inquire control passage log in the described request inquired Lan device proxy gateway send set up Data Channel Command；

The proxy gateway of the lan device that described request logs in sends to described proxy server and sets up number According to channel request message；

The proxy gateway of the lan device that described proxy server, described request log in is set up each other Data channel.

8. system as claimed in claim 5, it is characterised in that

The proxy gateway of the lan device that the described request inquired logs in, for by described operation data Transmission asks the lan device of operation to user, including:

Described proxy gateway receives the packet that described proxy server sends；

Described packet is forwarded to described user and asks the lan device of operation by described proxy gateway.

9. the user of a lan device accesses door, it is characterised in that

Described user accesses door, including proxy module, and receiver module, enquiry module, described act on behalf of mould Block includes multiple proxy server；

Described proxy server controls letter with the proxy gateway foundation transmission of the gateway as lan device The control passage of order；

Described user accesses door, including:

Receiver module, for receiving the request of user operation lan device, and sets user's local area network Standby operation data are sent to described proxy server；

Enquiry module, for the proxy gateway of the lan device that inquiry request logs in, and this acts on behalf of net Close the control passage set up with described proxy server；

Described proxy module, the generation of the lan device for being logged in described request by proxy server Reason gateway utilizes the control passage inquired, and sets up data channel；To be received by proxy server User is operated data and is sent to the agency inquired by described data channel described lan device Gateway.

10. user as claimed in claim 9 accesses door, it is characterised in that

Described proxy server controls letter with the proxy gateway foundation transmission of the gateway as lan device The control passage of order, including:

Described proxy gateway accesses door to described user and sends inquiry message；

Described user accesses door and sends the proxy server list information having been switched on to described agency Gateway；

Described proxy gateway sends connection establishment request to the described proxy server having been switched on；

The described proxy server having been switched on receives the connection establishment request that described proxy gateway sends,

Control is set up with described proxy gateway by setting up the proxy server being connected the soonest with described proxy gateway Passage processed.

11. users as claimed in claim 9 access door, it is characterised in that

Described proxy module, the generation of the lan device for being logged in described request by proxy server Reason gateway utilizes the control passage inquired, and sets up data channel, including:

The generation of the lan device that described proxy server is logged in described request by described control passage Reason gateway sends sets up Data Channel Command；

The proxy gateway of the lan device that described request logs in sends to described proxy server and sets up number According to channel request message；

Described proxy server receives described request message；

Described proxy server, described in find request log in lan device proxy gateway set up Data channel each other.