Patent Description:
Devices, such as routers or switches, usually are not configured (unconfigured) before delivery. When devices are unconfigured, a deployment engineer usually cooperates with a network administrator to power on the devices and perform initial configuration on the devices, to ensure that the devices can run properly and support specific service requirements. This process is referred to as a device configuration process or a device deployment process. Currently, a commonly-used device configuration method includes: First, a network administrator performs service planning (for example, a quantity of devices located at a site, and services that are supported by each device) for a site by using a network management device, and the network management device generates, according to the service planning, service configuration information of devices located at each site. At this point, these devices have not gone online yet, and the service configuration information of these devices is stored on the network management device. Second, the network administrator obtains an equipment serial number (equipment serial number, ESN) of a to-be-configured device at a site from a delivery person or a deployment engineer, and inputs the ESN of the to-be-configured device on the network management device, and the network management device establishes a correspondence between the ESN of the to-be-configured device and service configuration information of the to-be-configured device. Then, after the to-be-configured device is registered with the network management device, the network management device searches for the service configuration information of the to-be-configured device by using the ESN of the to-be-configured device, and delivers the found service configuration information to the to-be-configured device. Usually after the network administrator inputs the ESN of the to-be-configured device on the network management device, the network management device further needs to establish an association relationship between the ESN of the to-be-configured device and the site (that is, bind the to-be-configured device to the site). In this way, the network management device may learn of a correspondence between a site and service configuration information, to help the network administrator conveniently manage (for example, add, delete, or modify) the service configuration information based on the site.

In the foregoing device configuration method, an ESN of a device is bound to a site at which the device is located. Therefore, it is strictly required that a device with a specific ESN be delivered to a specific site, which raises high requirements on professional skills of a delivery person. Otherwise, services configured for a site may be incorrect. For example, it is assumed that a device <NUM> is located at a site <NUM>, an ESN <NUM> of the device <NUM> is bound to the site <NUM>, and an association relationship exists between the ESN <NUM> of the device <NUM> and configuration information of a service <NUM>; and a device <NUM> is located at a site <NUM>, an ESN <NUM> of the device <NUM> is bound to the site <NUM>, and an association relationship exists between the ESN <NUM> of the device <NUM> and configuration information of a service <NUM>. That is, the service <NUM> should be configured for the site <NUM> (to be specific, the service <NUM> should be configured for the device <NUM> that is corresponding to the ESN <NUM> and that is located at the site <NUM>), and the service <NUM> should be configured for the site <NUM> (to be specific, the service <NUM> should be configured for the device <NUM> that is corresponding to the ESN <NUM> and that is located at the site <NUM>). In this case, if the device <NUM> is delivered to the site <NUM> by mistake, during configuration of the device <NUM>, the configuration information of the service <NUM> is found according to the ESN <NUM> of the device <NUM>. As a result, a service configured for the site <NUM> is the service <NUM>. Similarly, if the device <NUM> is delivered to the site <NUM> by mistake, a service configured for the site <NUM> is the service <NUM>. <CIT> describes a method and system for providing access to software. A network reference (e.g., a URL) comprising a key is provided to a computer in an organization. The key can be used to download software. A method that comprises: receiving a first token and an encryption key from a first device, wherein a second token can be received from a second device, and a determination can be made as to whether the first token matches the second token so to provide configuration information to the second device if the second token matches the first token, is known from <CIT>.

The present invention is defined by the independent claims and concerns a device configuration method, system, and apparatus. Before a to-be-configured device is registered, an ESN of the to-be-configured device is not bound to a site. Therefore, a device with a specific ESN does not need to be delivered to a specific site, which has a comparatively low requirement on professional skills of a delivery person, and can reduce labor costs and time costs required for delivery. Particular embodiments are specified in the dependent claims.

The device configuration method is applied to a to-be-configured device. The method includes: receiving verification information (for example, a token) from a network management device, where the verification information is generated by the network management device based on the to-be-configured device, an association relationship exists between the verification information and service configuration information of the to-be-configured device, and the verification information is used for registering the to-be-configured device with the network management device; sending a registration request to the network management device, where the registration request includes the verification information; and receiving the service configuration information sent by the network management device, and performing configuration according to the service configuration information. Receiving the verification information comprises: receiving a uniform resource locator URL link from an auxiliary configuration device, wherein a parameter of the URL link comprises the verification information. The parameter of the URL link is encrypted. The method further comprises pushing, to the auxiliary configuration device, a portal page to receive, from a user, an input of a decryption key; receiving, from the auxiliary configuration device, the decryption key, and decrypting the received verification information based on the decryption key. In this way, the transmission security of the verification information can be improved. The registration request further comprises an identifier of the to-be-configured device; and the identifier of the to-be-configured device is used by the network management device to perform trustlist verification on the to-be-configured device. The identifier is an equipment serial number, ESN. and a trustlist is a set of ESNs of devices supported by the network management device. If the ESN of the to-be-configured device is in the trustlist, the trustlist verification is successful, and if the ESN of the to-be-configured device is not in the trustlist, the trustlist verification fails.

In a possible design, the parameter of the URL link further includes an address of the network management device and/or a management interface parameter of the to-be-configured device, and the management interface parameter is an address of the to-be-configured device or is used for obtaining the address of the to-be-configured device. The address of the network management device may be an IP address or a domain name of the network management device. The management interface parameter of the to-be-configured device may be a WAN interface parameter of the to-be-configured device, such as an IPoE parameter, a DHCP parameter, or a PPPoE parameter. An IP address of a WAN interface may be obtained based on the DHCP parameter or the PPPoE parameter. Currently, a deployment engineer usually inputs (for example, through a command line) the address of the network management device and the management interface parameter of the to-be-configured device on the auxiliary configuration device. In this possible design, the address of the network management device and/or the management interface parameter of the to-be-configured device are/is transferred by using the URL link.

This is simple and convenient, has a low requirement on professional skills of the deployment engineer, and can reduce labor costs and time costs required for device configuration.

In a possible design, the registration request further includes the address of the network management device and the address of the to-be-configured device.

The registration request further includes an identifier of the to-be-configured device (for example, an ESN of the to-be-configured device); and the identifier of the to-be-configured device is used by the network management device to perform trustlist verification on the to-be-configured device.

The device configuration system includes a network management device, an auxiliary device and a to-be-configured device. The network management device is configured to generate verification information based on the to-be-configured device, and send the verification information to the to-be-configured device, where an association relationship exists between the verification information and service configuration information of the to-be-configured device. The to-be-configured device is configured to send a registration request to the network management device, where the registration request includes the verification information. The network management device is further configured to perform verification on the to-be-configured device based on the verification information, and send the service configuration information to the to-be-configured device. The to-be-configured device is further configured to perform configuration according to the service configuration information.

The network management device is specifically configured to send a URL link to the auxiliary configuration device; and correspondingly, the auxiliary configuration device is configured to send the URL link to the to-be-configured device, where a parameter of the URL link includes the verification information. The parameter of the URL link is encrypted. The to-be-configured device is further configured to push a portal page to receive, from a user, an input of a decryption key; and the auxiliary configuration device is further configured to: after detecting the decryption key input by the user, send the decryption key to the to-be-configured device. The to-be-configured device is further configured to decrypt the encrypted parameter of the URL link based on the decryption key.

The registration request further includes an identifier of the to-be-configured device, wherein the identifier of the to-be-configured device is an equipment serial number, ESN, of the to-be-configured device, where the network management device is further configured to perform trustlist verification on the to-be-configured device based on the identifier of the to-be-configured device; and correspondingly, the network management device is configured to send the service configuration information to the to-be-configured device after the to-be-configured device is successfully verified based on both the verification information and the identifier of the to-be-configured device.

In a possible design, the parameter of the URL link further includes an address of the network management device and/or a management interface parameter of the to-be-configured device, and the management interface parameter is an address of the to-be-configured device or is used for obtaining the address of the to-be-configured device. Correspondingly, the registration request further includes the address of the network management device and the address of the to-be-configured device.

In a possible design, the network management device stores an identifier of at least one site, and the at least one site includes a site at which the to-be-configured device is located, where the network management device is further configured to establish an association relationship between the identifier of the to-be-configured device and the identifier of the site at which the to-be-configured device is located after the trustlist verification is successfully performed on the to-be-configured device.

In a possible design, the verification information has a period of validity.

For key terms and beneficial effects of the technical solutions provided in the device configuration system, refer to the key terms and beneficial effects of the technical solutions provided in the device configuration method.

The device configuration apparatus is configured to perform the device configuration method. The device configuration apparatus may be specifically a chip.

In a possible design, the device configuration apparatus includes modules configured to perform the claimed device configuration method.

In a possible design, the device configuration apparatus includes a memory and a processor, where the memory is configured to store a computer instruction, and when the device configuration apparatus runs, the processor executes the computer instruction in the memory to perform, by using a hardware resource in the device configuration apparatus, the operation steps of the claimed device configuration method.

In one example, the "sending" operation recited above may be understood as an output operation performed by the processor in the possible design. The "receiving" operation recited above may be understood as an input operation performed by the processor in the possible design.

In another example, the device configuration apparatus further includes a receiver and a sender, and the "sending" operation recited above may be understood as an operation performed by the sender under control of the processor in the possible design. The "receiving" operation recited above may be understood as an operation performed by the receiver under control of the processor in the possible design. -A computer readable storage medium that stores a computer program is related to the present invention. When the computer program runs on a computer, the computer is enabled to perform the operation steps of the claimed device configuration method.

A computer program product is further related to the present invention. When the computer program product runs on a computer, the computer is enabled to perform the operation steps of the claimed device configuration method.

It may be understood that any one of the device configuration apparatuses, the computer readable storage medium, the computer program product, or the like provided above is configured to perform the corresponding method provided above. Therefore, for beneficial effects that can be achieved by the device configuration apparatus, the computer readable storage medium, the computer program product, or the like, refer to the beneficial effects in the device configuration method.

In this application, "at least one" includes one or more. "Multiple" refers to two or more than two. For example, at least one of A, B, or C includes: Only A exists, only B exists, both A and B exist, both A and C exist, both B and C exist, and both A, B, and C exist. In description of this application, "/" means "or" unless otherwise specified. For example, A/B may represent A or B. In this specification, "and/or" describes only an association relationship for describing associated objects and represents that three relationships may exist.

<FIG> is a schematic architectural diagram of a device configuration system according to an embodiment of this application. The device configuration system includes a network management device <NUM> and at least one to-be-configured device <NUM>. In <FIG>, an example in which the device configuration system includes one to-be-configured device <NUM> is used for description. Optionally, the device configuration system may further include an auxiliary configuration device <NUM>. In the device configuration system:
The network management device <NUM> is configured to manage an association relationship between a site and the to-be-configured device <NUM>, service configuration information of the to-be-configured device <NUM>, and the like. In addition, the network management device <NUM> is further configured to generate verification information such as a token (token).

The service configuration information of the to-be-configured device <NUM> is information that needs to be configured when the to-be-configured device <NUM> supports one (type of) service or a plurality of (types of) services. The service may be a broadband service, an internet protocol television (internet protocol television, IPTV) service, or the like. The verification information is information used when verification is performed on the to-be-configured device <NUM> in a process in which the to-be-configured device <NUM> is registered with the network management device <NUM>. The site is a physical location in which the to-be-configured device <NUM> is located, for example, a room number of a building in a community. The network management device <NUM> may manage one or more sites, and one or more to-be-configured devices <NUM> may be deployed at each site. In addition, for ease of description, a concept of "configuring a service for a site" is introduced hereby, and specifically refers to configuring a service for a device located at the site. A unified description is provided herein, and details are not described again in the following.

The to-be-configured device <NUM> is customer premises equipment (customer premises equipment, CPE) that is unconfigured and that currently has a configuration requirement, for example, a router or a switch. The network management device <NUM> sends the service configuration information to the to-be-configured device <NUM> only after the to-be-configured device <NUM> is registered with the network management device <NUM>. A process of registering the to-be-configured device <NUM> with the network management device <NUM> includes: The to-be-configured device <NUM> sends a registration request that includes the verification information to the network management device <NUM>, and the network management device <NUM> performs verification on the to-be-configured device <NUM> based on the verification information. If the verification succeeds, it indicates that the registration succeeds.

The auxiliary configuration device <NUM> is configured to establish a connection path between the network management device <NUM> and the to-be-configured device <NUM>, so that the network management device <NUM> can send, to the to-be-configured device <NUM>, information (such as the verification information, an address of the network management device <NUM>, and/or a management interface parameter of the to-be-configured device <NUM>) required in the registration process. In addition, the auxiliary configuration device <NUM> may further send, to the to-be-configured device <NUM>, information (for example, a decryption key in the following) input by a deployment engineer. The auxiliary configuration device <NUM> may be a device that has a function of connecting to the to-be-configured device <NUM> and has a function of receiving information input by a user (for example, including an input apparatus such as a keyboard or a mouse), such as a smartphone, a tablet computer, a notebook computer, or a desktop computer.

The auxiliary configuration device <NUM> may be connected to the to-be-configured device <NUM> in a wired manner, for example, by using a network cable or a universal serial bus (universal serial bus, USB) cable, or may be connected to the to-be-configured device <NUM> in a wireless manner, for example, by using Wi-Fi or Bluetooth.

It may be understood that, if a to-be-configured device <NUM> can be directly connected to the network management device <NUM> and has a function of receiving information input by a user, the device configuration system may not include the auxiliary configuration device <NUM>.

Concepts such as "network administrator", "delivery person", and "deployment engineer" are further introduced in this application. Details are provided in the following.

A network administrator is a user who inputs information into the network management device <NUM>. The information may be service planning information (for example, a quantity of devices located at a site, and services that are supported by each device), a period of validity of verification information, and the like.

A delivery person is a user who delivers the to-be-configured device <NUM> to a site.

A deployment engineer can also be referred to as an onsite installation engineer or onsite deployment engineer. If the device configuration system includes the auxiliary configuration device <NUM>, the deployment engineer may be responsible for installing the to-be-configured device <NUM> on site, powering on the to-be-configured device <NUM>, connecting the to-be-configured device <NUM> to the auxiliary configuration device <NUM>, and the like. In addition, the deployment engineer may be further responsible for inputting information, for example, a decryption key, into the auxiliary configuration device <NUM>. If the device configuration system does not include the auxiliary configuration device <NUM>, the deployment engineer may be responsible for installing the to-be-configured device <NUM> on site, powering on the to-be-configured device <NUM>, inputting information, such as a decryption key, into the to-be-configured device <NUM>, and the like.

The device configuration system shown in <FIG> is merely an example of a system applicable to the technical solutions provided herein, and does not constitute a limitation on the system applicable to the technical solutions provided herein. In addition, for steps performed by each device (for example, the network management device <NUM>, the to-be-configured device <NUM>, and the auxiliary configuration device <NUM>) in <FIG>, refer to the methods described in the following, and details are not described herein.

Each of the to-be-configured device <NUM>, and the auxiliary configuration device <NUM> in <FIG> may be implemented by using a communications device <NUM> in <FIG>. The communications device <NUM> includes at least one processor <NUM>, a communications line <NUM>, a memory <NUM>, and at least one communications interface <NUM>.

The processor <NUM> may be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (application-specific integrated circuit, ASIC), or one or more integrated circuits configured to control program execution in the solutions of this application.

The communications line <NUM> may include a path for transferring information between the foregoing components (for example, the at least one processor <NUM>, the communications line <NUM>, the memory <NUM>, and the at least one communications interface <NUM>).

The communications interface <NUM> uses any apparatus such as a transceiver, and is configured to communicate with another device or a communications network, such as a wide area network (wide area network, WAN) or a local area network (local area network, LAN).

The memory <NUM> may be a read-only memory (read-only memory, ROM) or another type of static storage device capable of storing static information and an instruction, or a random access memory (random access memory, RAM) or another type of dynamic storage device capable of storing information and an instruction. The memory <NUM> may also be an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), a compact disc read-only memory (compact disc read-only memory, CD-ROM) or other compact disc storage, optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, and the like), a magnetic disk storage medium or another magnetic storage device, or any other medium capable of carrying or storing expected program code in a form of an instruction or a data structure and capable of being accessed by a computer, but is not limited thereto. The memory <NUM> may exist independently, and is connected to the processor <NUM> by using the communications line <NUM>. The memory <NUM> may alternatively be integrated with the processor <NUM>. The memory <NUM> provided in this embodiment of this application may usually be non-volatile. The memory <NUM> is configured to store a computer instruction for executing the solutions of this application, and the execution is controlled by the processor <NUM>. The processor <NUM> is configured to execute the computer instruction stored in the memory <NUM>, to implement the method provided in the following embodiments of this application.

Optionally, the computer instruction in this embodiment of this application may also be referred to as application program code. This is not specifically limited in this embodiment of this application.

In specific implementation, in an embodiment, the communications device <NUM> may include a plurality of processors, for example, the processor <NUM> and a processor <NUM> in <FIG>. Each of these processors may be a single-core (single-CPU) processor, or may be a multi-core (multi-CPU) processor. The processor herein may be one or more devices, circuits, and/or processing cores configured to process data (for example, a computer program instruction).

In specific implementation, in an embodiment, the communications device <NUM> may further include an output device <NUM> and/or an input device <NUM>. The output device <NUM> communicates with the processor <NUM>, and may display information in a plurality of manners. For example, the output device <NUM> may be a liquid crystal display (liquid crystal display, LCD), a light-emitting diode (light-emitting diode, LED) display device, a cathode-ray tube (cathode-ray tube, CRT) display device, or a projector (projector). The input device <NUM> communicates with the processor <NUM>, and may receive, in a plurality of manners, input from a user. For example, the input device <NUM> may be a mouse, a keyboard, a touchscreen device, or a sensing device.

<FIG> is a schematic diagram of a product form of a to-be-configured device <NUM> according to an embodiment of this application. The to-be-configured device <NUM> shown in <FIG> includes a WAN interface <NUM>, at least one LAN interface <NUM>, and indicators "SYS" <NUM>, "WAN" <NUM>, and "MNG" <NUM>. In the to-be-configured device <NUM>:
In an example, with reference to <FIG>, the WAN interface <NUM> and the LAN interface <NUM> may be considered as specific implementations of the communications interface <NUM>. The indicators "SYS" <NUM>, "WAN" <NUM>, and "MNG" <NUM> may be considered as specific implementations of the output device <NUM>. A deployment engineer may learn of a running status of the to-be-configured device <NUM> through these indicators. One or more of these indicators are optional. The WAN interface <NUM> is an interface configured to enable the to-be-configured device <NUM> to connect to a WAN network such as an internet (internet) network. A connection manner used for connecting to the WAN network is, for example but is not limited to, an internet protocol (internet protocol, IP) manner, a dynamic host configuration protocol (dynamic host configuration protocol, DHCP) manner, or a point-to-point protocol over ethernet (point-to-point protocol over ethernet, PPPoE) manner. The WAN interface <NUM> may be used as a management interface of the to-be-configured device <NUM>, that is, an interface connecting the to-be-configured device <NUM> and a network management device <NUM>.

The LAN interface <NUM> is an interface configured to enable the to-be-configured device <NUM> to connect to a LAN network. In an example, an IP address (for example, <NUM>. <NUM>) of one LAN interface <NUM> of the to-be-configured device <NUM> is predefined before the to-be-configured device <NUM> is delivered, and may be used for connecting to an auxiliary configuration device <NUM>. Another LAN interface <NUM> may be configured to connect to another device such as a switch.

The indicator "SYS" <NUM> is configured to indicate whether the to-be-configured device <NUM> is in a normal system status. The indicator "WAN" <NUM> is configured to indicate whether the WAN interface <NUM> is successfully connected to a WAN network, that is, whether an IP address of the WAN interface <NUM> is obtained.

The indicator "MNG" <NUM> is a management indicator, and is configured to indicate whether the to-be-configured device <NUM> is successfully connected to the network management device <NUM>, that is, configured to indicate whether the to-be-configured device <NUM> is successfully registered with the network management device <NUM>.

With reference to the accompanying drawings, the following describes a device configuration method provided in an embodiment of this application.

<FIG> and <FIG> are schematic interaction diagrams of a device configuration method according to an embodiment of this application.

S <NUM>: A network management device creates an association relationship between an identifier of a site, a first identifier of a device, and service configuration information. The device herein is an unconfigured device.

The identifier of a site may be a name of the site, and the like, such as a room number of a building in a community. The first identifier of a device may be an identifier such as a name of the device, and is used by a network administrator to view or manage information about the device. For example, the first identifier of a device may be an identifier defined by the network administrator, for example, an identifier that is defined based on one or more of physical locations of the devices, information about an operator to which a service provisioned for the device belongs, and bandwidth information of a service provisioned for the device. For example, the first identifier of a device may be "a telecommunications device (that is, a device for which a telecommunications service is provisioned) in room <NUM> on the third floor". It should be noted that a concept of the "first identifier of a device" is proposed in this embodiment of this application to distinguish between the "first identifier of a device" and a "second identifier of a device" in the following. The second identifier of a device is an identifier predefined when the device is delivered, for example, an ESN of the device.

In specific implementation, the network administrator may input, into the network management device, service planning information of a site managed by the network management device, for example, a quantity of devices located at a site, a first identifier of each device, and services supported by each device. Then, the network management device generates service configuration information of devices located at each site according to the service planning information. At this point, these devices have not gone online yet, and the service configuration information of these devices is stored on the network management device.

An example of the association relationship, created by the network management device, between an identifier of a site, a first identifier of a device, and service configuration information may be shown in Table <NUM>.

Table <NUM> may be understood as follows: The network administrator plans to deploy one device at each of the site <NUM> and the site <NUM>, and service configuration information of the two devices is the service configuration information <NUM> and the service configuration information <NUM> separately; and the network administrator plans to deploy two devices at the site <NUM>, and service configuration information of the two devices is the service configuration information <NUM> and the service configuration information <NUM> separately.

S102: The network management device determines a to-be-configured site (that is, a site that currently has a configuration requirement). For example, it may be any one of the sites in Table <NUM>. Specifically, the network administrator may learn of the to-be-configured site from a delivery person or an onsite installation person.

S103: The network management device generates verification information based on a to-be-configured device at the to-be-configured site, where an association relationship exists between the verification information and service configuration information of the to-be-configured device.

The verification information may be any form of information that can be used for performing verification on the to-be-configured device. For example, the verification information may be a character or a character string. Optionally, the verification information is a token. In computer identity authentication, the token refers to a token, is generally used in invitation or system login, and may be referred to as an invitation code, a verification code, or the like.

It may be understood that, when S103 is performed, the network management device has not learned of a second identifier of the to-be-configured device (that is, an ESN of the to-be-configured device), but has created a first identifier of the to-be-configured device. In this case, the network management device may generate the verification information based on the first identifier of the to-be-configured device.

In S103, the network management device generates the verification information by using a to-be-configured device as a granularity. Specifically, if there are N devices located at the to-be-configured site, the network management device generates N pieces of verification information. The verification information is in a one-to-one correspondence with the device at the to-be-configured site. N is an integer greater than or equal to <NUM>.

Optionally, the verification information has a period of validity. The period of validity of the verification information may be a default value, or may be a value input by the network administrator into the network management device. The period of validity of the verification information may be a period of time starting from a moment at which the network management device generates the verification information. If the period of validity of the verification information is exceeded, the verification information becomes invalid. In this case, the network management device needs to regenerate verification information, and then continues to perform the following S104. In this way, security of a registration process can be improved. Based on this, in specific implementation, the network management device may record a time at which the network management device generates the verification information.

For example, assuming that each device in Table <NUM> is a to-be-configured device, after S103 is performed, information stored in the network management device may be shown in Table <NUM>.

S104: The network management device sends a uniform resource locator (uniform resource locator, URL) link to an auxiliary configuration device. A destination address in the URL link points to the to-be-configured device (for example, the destination address may be <NUM>. A parameter of the URL link includes the verification information of the to-be-configured device (that is, the verification information generated in S103).

For example, the network management device sends the URL link to the auxiliary configuration device by using an email. In addition, the network management device may also send the URL link to the auxiliary configuration device in another manner, for example, send the URL link by using an instant messaging tool (such as a short message or WeChat) installed in the auxiliary configuration device. For another example, the URL link is sent by using a specific application (application, App) installed in the auxiliary configuration device.

Optionally, the parameter of the URL link may further include an address of the network management device and/or a management interface parameter of the to-be-configured device. The address of the network management device may be an IP address or a domain name of the network management device. The management interface parameter of the to-be-configured device may be a WAN interface parameter of the to-be-configured device, for example, may be an IPoE parameter (for example, including an IP address of a management interface, namely, a WAN interface, that is of the to-be-configured device and that is used to connect to the network management device), a DHCP parameter, or a PPPoE parameter (for example, including a username and a password). The IP address of the WAN interface may be obtained based on the DHCP parameter or the PPPoE parameter. Alternatively, the address of the network management device and/or the management interface parameter of the to-be-configured device may be input into the auxiliary configuration device by a deployment engineer, for example, input into the auxiliary configuration device in a command line manner, and then is sent to the to-be-configured device by the auxiliary configuration device.

The parameter of the URL link is encrypted. An advantage of encryption is that the auxiliary configuration device cannot obtain the verification information, which provides further security.

S105: The auxiliary configuration device sends the parameter of the URL link to the to-be-configured device.

Specifically, the deployment engineer installs and powers on the to-be-configured device, and connects the auxiliary configuration device and the to-be-configured device. Then, after the URL link is clicked, the auxiliary configuration device sends a hypertext transfer protocol (hypertext transfer protocol, HTTP) request to the to-be-configured device according to the URL link. Web server (web server) software may be built in the to-be-configured device to parse the HTTP request, for example, to parse out which field of the HTTP request carries which parameter of the URL link, to obtain content of the HTTP request, that is, the parameter of the URL link.

In some embodiments, the network management device may send installation operation information to the auxiliary configuration device, to instruct the deployment engineer to install and power on the to-be-configured device, connect the to-be-configured device to the auxiliary configuration device, and the like. In an example, the network management device may send the installation operation information and the URL link together as mail content to the auxiliary configuration device.

Optionally, if there is a plurality of devices located at the to-be-configured site, the network management device may send a plurality of URL links to the auxiliary configuration device, where the URL links are in a one-to-one correspondence with the devices. The network management device may further send operator information, bandwidth information, or the like that is corresponding to each URL link to the auxiliary configuration device, so that the deployment engineer may install the to-be-configured device based on the information, and select and click one of the plurality of URL links, to enable the auxiliary configuration device to perform S105.

For example, it is assumed that devices located at the to-be-configured site include a device A and a device B, a service of a "telecom" operator is provisioned for one of the two devices, and a service of a "mobile" operator is provisioned for the other device. In this case, the network management device may send the following information to the auxiliary configuration device: ["telecom" operator, URL link <NUM>] and ["mobile" operator, URL link <NUM>]. In other words, a parameter of the URL link <NUM> is related to "telecom", and a parameter of the URL link <NUM> is related to "mobile". The deployment engineer may connect the device A to a telecommunications network interface and click the URL link <NUM>, so that the auxiliary configuration device sends the parameter of the URL link <NUM> to the device A. Similarly, the deployment engineer may connect the device B to a mobile network interface and click the URL link <NUM>, so that the auxiliary configuration device sends the parameter of the URL link <NUM> to the device B.

S104 to S105 are a specific implementation in which the network management device sends the verification information of the to-be-configured device to the to-be-configured device. This embodiment of this application is not limited thereto. For example, if the to-be-configured device may directly communicate with the network management device, the network management device may directly send the verification information of the to-be-configured device to the to-be-configured device, and does not need forwarding performed by the auxiliary configuration device. For another example, a USB flash drive may be inserted into the auxiliary configuration device to import the verification information of the to-be-configured device, and then the auxiliary configuration device sends the imported verification information to the to-be-configured device.

The parameter of the URL link is encrypted, and S106 to S112 are performed. If the parameter of the URL link is not encrypted, S108 to S <NUM>, which concern a comparative example outside of the scope of the claims, are performed. In the present invention, however, the parameter of the URL link is encrypted, and the fact that the parameter of the URL link is encrypted is predefined, or is indicated by the network management device by sending information to the to-be-configured device (for example, sending the information to the to-be-configured device by using auxiliary configuration device). This is not limited in this embodiment of this application.

S106: The to-be-configured device obtains a decryption key from the auxiliary configuration device.

Specifically, the to-be-configured device pushes a portal (entry or portal) page to the auxiliary configuration device, and the deployment engineer inputs a decryption key on the portal page. After detecting the decryption key input by the deployment engineer, the auxiliary configuration device sends the decryption key to the to-be-configured device.

S107: The to-be-configured device decrypts the encrypted parameter of the URL link based on the decryption key, to obtain the decrypted parameter of the URL link.

A decryption algorithm used when the to-be-configured device performs decryption may be predefined, or may be indicated by the network management device by sending information to the to-be-configured device (for example, sending the information to the to-be-configured device by using auxiliary configuration device). This is not limited in this embodiment of this application. The decryption algorithm used by the to-be-configured device is corresponding to an encryption algorithm that is used when the network management device encrypts the parameter of the URL link. S108: The to-be-configured device sends a registration request to the network management device, where the registration request includes the verification information of the to-be-configured device (that is, the verification information generated in S <NUM>), and may further include the address of the network management device and an address of the to-be-configured device. The verification information included in the registration request may be not encrypted. This is not limited in this embodiment of this application. In the registration request, the address of the network management device is a destination address, and the address of the to-be-configured device (for example, the IP address of the WAN interface) is a source address.

The registration request further includes the second identifier of the to-be-configured device, for example, the ESN of the to-be-configured device.

S109: The network management device performs verification on the to-be-configured device based on the verification information of the to-be-configured device. If the verification is successful, it indicates that the to-be-configured device is successfully registered with the network management device.

For example, the network management device may determine whether the verification information of the to-be-configured device that is included in the registration request is the same as the verification information of the to-be-configured device (that is, the verification information generated in S103) that is stored in the network management device. If they are the same, the verification is successful. If they are not the same, the verification fails. Optionally, if the verification fails, the network management device may return to perform S <NUM>, that is, regenerate verification information of the to-be-configured device.

The registration request further includes an identifier of the to-be-configured device, wherein the identifier of the to-be-configured device is the ESN of the to-be-configured device, the network management device performs trustlist verification on the to-be-configured device based on the identifier of the to-be-configured device. Based on this, S109 includes: sending the service configuration information of the to-be-configured device to the to-be-configured device after the to-be-configured device is successfully verified based on both the verification information of the to-be-configured device and the identifier of the to-be-configured device. A trustlist is a set of ESNs of devices supported by the network management device. If the ESN of the to-be-configured device is in the trustlist, the trustlist verification is successful. If the ESN of the to-be-configured device is not in the trustlist, the trustlist verification fails. In this case, the to-be-configured device cannot be registered with the network management device. In this way, security of the registration process can further be improved.

S110: The network management device finds the service configuration information of the to-be-configured device according to the verification information of the to-be-configured device.

For example, based on Table <NUM>, assuming that the verification information of the to-be-configured device is DFASFDAF3, the service configuration information of the to-be-configured device is the service configuration information <NUM>.

S111: The network management device sends the found service configuration information to the to-be-configured device.

S112: The to-be-configured device performs configuration according to the service configuration information.

After S112 is performed, the to-be-configured device can run properly and support a specific service requirement. For a specific configuration process, refer to the prior art. Subsequently, the to-be-configured device may send information to the auxiliary configuration device, so that a portal page displays a prompt message indicating that the configuration succeeds or fails. Alternatively, the deployment engineer can determine whether the configuration is successful based on an indicator on the to-be-configured device (as shown in <FIG>). Certainly, this embodiment of this application is not limited thereto.

In the technical solutions provided herein, service configuration information corresponding to a site is configured on a device located at the site, which helps implement that a correct service is configured for the site. In the technical solutions, before registration, an ESN of a to-be-configured device is not bound to a site. Therefore, a device with a specific ESN does not need to be delivered to a specific site, which has a comparatively low requirement on professional skills of a delivery person, and can reduce labor costs and time costs required for delivery. In addition, in a process of configuring the to-be-configured device, the ESN of the to-be-configured device does not need to be used. Therefore, a network administrator does not need to input the ESN of the to-be-configured device into a network management device. However, in the prior art, an ESN of a to-be-configured device needs to be used for verification; and in addition, the ESN is usually manually input into a network management device by a network administrator, and manual input is prone to errors.

In the following, specific examples are used to describe that the technical solutions provided herein can resolve a problem in the prior art that a service configured for a site is incorrect due to a delivery error.

Example <NUM>: It is assumed that an ESN of a device delivered to a site <NUM> is "E1111111111", an ESN of a device delivered to a site <NUM> is "E2222222222", and ESNs of devices delivered to a site <NUM> are "E3333333333" and "E4444444444" separately. In this case, based on Table <NUM>, after registration is completed, information stored in a network management device may be shown in Table <NUM>.

It may be understood that, the ESN of the device <NUM> shown in Table <NUM> may be replaced with E4444444444, and correspondingly, the ESN of the device <NUM> shown in Table <NUM> is replaced with E3333333333, to obtain a new table.

Example <NUM>: It is assumed that an ESN of a device delivered to a site <NUM> is "E2222222222", an ESN of a device delivered to a site <NUM> is "E1111111111", and ESNs of devices delivered to a site <NUM> are "E3333333333" and "E4444444444" separately. In this case, based on Table <NUM>, after registration is completed, information stored in a network management device may be shown in Table <NUM>.

It may be understood that, the ESN of the device <NUM> shown in Table <NUM> may be replaced with E4444444444, and correspondingly, the ESN of the device <NUM> shown in Table <NUM> is replaced with E3333333333, to obtain a new table. By comparing Table <NUM> and Table <NUM>, it can be learned that, if the devices identified by "E1111111111" and "E2222222222" are of a same model, no matter which one of the two devices is delivered to the site <NUM> and which one of the two devices is delivered to the site <NUM>, it can be ensured that service configuration information configured for the site <NUM> is the service configuration information <NUM>, and service configuration information configured for the site <NUM> is the service configuration information <NUM>. In other words, services configured for the site <NUM> and the site <NUM> are not affected. Therefore, compared with the technical solutions in the prior art in which a device with a specific ESN must be strictly delivered to a specific site, the technical solutions provided herein can resolve the problem in the prior art that a service configured for a site is incorrect due to a delivery error.

It should be noted that to-be-configured devices of different types (or models) have different performance parameters (for example, an interface type or a processing rate of a memory or processor). Therefore, on a basis that an ESN of a to-be-configured device is not bound to a site, to ensure that performance of the to-be-configured device is performance expected by a user, the embodiments of this application support a technical solution in which a site is bound to a device type (or model). Based on this, during delivery to a specific site, a delivery person only needs to deliver a device that meets a device type requirement and that is of the specific site, which helps implement that a correct service is configured for the site.

Optionally, if the registration request further includes an identifier of the to-be-configured device (for example, the ESN of the to-be-configured device), the network management device may establish an association relationship between the to-be-configured device and a site at which the to-be-configured device is located, that is, bind the to-be-configured device to the site. In this way, it may be convenient for the network management device to manage devices, for example, adding identifiers of some devices to a blocklist based on a site.

The foregoing mainly describes the solutions provided herein from a perspective of a method. To implement the foregoing functions, corresponding hardware structures and/or software modules for performing the functions are included in the solutions. A person skilled in the art should easily be aware that, in combination with units and algorithm steps of the examples described in the embodiments disclosed in this specification, this application may be implemented by hardware or a combination of hardware and computer software. Whether a function is performed by hardware or hardware driven by computer software depends on particular applications and design constraints of the technical solutions.

Functional module division may be performed for a network management device and a to-be-configured device based on the foregoing method examples. For example, each functional module may be obtained through division based on a corresponding function, or two or more functions may be integrated into one processing module. The integrated module may be implemented in a form of hardware, or may be implemented in a form of a software functional module. It should be noted that, in this embodiment of this application, module division is exemplary, and is merely a logical function division. In actual implementation, another division manner may be used.

<FIG> is a schematic structural diagram of a network management device <NUM> according to an embodiment of this application. In an example, the network management device <NUM> may be configured to perform the steps performed by the network management device in the device configuration method shown in <FIG> and <FIG>. The network management device <NUM> may include a processing unit <NUM>, a sending unit <NUM>, and a receiving unit <NUM>.

The processing unit <NUM> is configured to generate verification information based on a to-be-configured device, where an association relationship exists between the verification information and service configuration information of the to-be-configured device. The sending unit <NUM> is configured to send the verification information to the to-be-configured device. The receiving unit <NUM> is configured to receive a registration request from the to-be-configured device, where the registration request includes the verification information. The processing unit <NUM> is further configured to perform verification on the to-be-configured device based on the verification information. The sending unit <NUM> is further configured to send the service configuration information to the to-be-configured device. For example, with reference to <FIG> and <FIG>, the processing unit <NUM> may be configured to perform S103 and S <NUM>, the sending unit <NUM> may be configured to perform S104 and S111, and the receiving unit <NUM> may be configured to perform a receiving step corresponding to S108.

Optionally, the sending unit <NUM> is specifically configured to send a URL link to an auxiliary configuration device, where a parameter of the URL link includes the verification information. For example, with reference to <FIG> and <FIG>, the sending unit <NUM> may be configured to perform S <NUM>.

Optionally, the verification information has a period of validity.

The registration request further includes an identifier of the to-be-configured device. Correspondingly, the processing unit <NUM> is further configured to perform trustlist verification on the to-be-configured device based on the identifier of the to-be-configured device, and the identifier of the to-be-configured device is an ESN of the to-be-configured device. The sending unit <NUM> is configured to send the service configuration information to the to-be-configured device after the to-be-configured device is successfully verified based on both the verification information and the identifier of the to-be-configured device.

Optionally, the network management device <NUM> stores an identifier of at least one site, and the at least one site includes a site at which the to-be-configured device is located. The processing unit <NUM> is further configured to establish an association relationship between the identifier of the to-be-configured device (for example, the ESN of the to-be-configured device) and an identifier of the site at which the to-be-configured device is located after the trustlist verification is successfully performed on the to-be-configured device.

Optionally, the sending unit <NUM> is specifically configured to send the verification information that is encrypted to the to-be-configured device.

For explanations of related content, descriptions of beneficial effects, and the like of any network management device <NUM> provided above, refer to the foregoing corresponding method embodiments. In an example, with reference to the communications device shown in <FIG>, the processing unit <NUM> may be implemented by using the processor <NUM> or the processor <NUM> in <FIG>. The sending unit <NUM> and the receiving unit <NUM> may be implemented by using the communications interface <NUM> in <FIG>.

<FIG> is a schematic structural diagram of a to-be-configured device <NUM> according to an embodiment of this application. In an example, the to-be-configured device <NUM> may be configured to perform the steps performed by the to-be-configured device in the device configuration method shown in <FIG> and <FIG>. The to-be-configured device <NUM> may include a receiving unit <NUM>, a sending unit <NUM>, and a processing unit <NUM>.

The receiving unit <NUM> is configured to receive verification information from a network management device, where the verification information is generated by the network management device based on the to-be-configured device, an association relationship exists between the verification information and service configuration information of the to-be-configured device, and the verification information is used for registering the to-be-configured device with the network management device. The sending unit <NUM> is configured to send a registration request to the network management device, where the registration request includes the verification information. The receiving unit <NUM> is further configured to receive the service configuration information sent by the network management device. The processing unit <NUM> is configured to perform configuration according to the service configuration information. For example, with reference to <FIG> and <FIG>, the receiving unit <NUM> may be configured to perform a receiving step corresponding to S105 and a receiving step corresponding to S111, the sending unit <NUM> may be configured to perform S108, and the processing unit <NUM> may be configured to perform S112.

The receiving unit <NUM> is specifically configured to receive a URL link sent by an auxiliary configuration device, where a parameter of the URL link includes the verification information, and the URL link is from the network management device. For example, with reference to <FIG> and <FIG>, the receiving unit <NUM> may be configured to perform the receiving step corresponding to S105.

Optionally, the parameter of the URL link further includes an address of the network management device and/or a management interface parameter of the to-be-configured device, and the management interface parameter is an address of the to-be-configured device or is used for obtaining the address of the to-be-configured device. The registration request further includes the address of the network management device and the address of the to-be-configured device. The registration request further includes an identifier of the to-be-configured device, the identifier of the to-be-configured device is an ESN of the to-be-configured device; and the identifier of the to-be-configured device is used by the network management device to perform trustlist verification on the to-be-configured device.

The received verification information is encrypted. The receiving unit <NUM> is further configured to receive a decryption key. The processing unit <NUM> is further configured to decrypt the received verification information based on the decryption key. For example, with reference to <FIG> and <FIG>, the receiving unit <NUM> may be configured to perform a receiving step corresponding to S106.

For explanations of related content, descriptions of beneficial effects, and the like of any to-be-configured device <NUM> provided above, refer to the foregoing corresponding method embodiments. In an example, with reference to the communications device shown in <FIG>, the processing unit <NUM> may be implemented by using the processor <NUM> or the processor <NUM> in <FIG>. The receiving unit <NUM> and the sending unit <NUM> may be implemented by using the communications interface <NUM> in <FIG>.

An embodiment of this application further provides a device configuration system. The system may include any network management device <NUM> provided above and a to-be-configured device configured by the network management device <NUM>. The system further includes an auxiliary configuration device that communicates with both the network management device <NUM> and the to-be-configured device.

All or some of the foregoing embodiments may be implemented by using software, hardware, firmware, or any computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable apparatuses. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (digital subscriber line, DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), a semiconductor medium (for example, a solid-state drive (solid state disk, SSD)), or the like.

Although this application is described with reference to the embodiments, in a process of implementing this application that claims protection, persons skilled in the art may understand and implement another variation of the disclosed embodiments by viewing the accompanying drawings, disclosed content, and the accompanying claims. In the claims, "comprising" does not exclude another component or another step, and "a" or "one" does not exclude a meaning of plurality. A single processor or another unit may implement several functions enumerated in the claims. Some measures are recorded in dependent claims that are different from each other, but this does not mean that these measures cannot be combined to produce a better effect.

Claim 1:
A device configuration method, applied to a to-be-configured device, wherein the method comprises:
receiving verification information from a network management device, wherein the verification information is generated by the network management device based on the to-be-configured device, an association relationship exists between the verification information and service configuration information of the to-be-configured device, and the verification information is used for registering the to-be-configured device with the network management device;
sending (S108) a registration request to the network management device, wherein the registration request comprises the verification information;
receiving (S111) the service configuration information sent by the network management device; and
performing (S112) configuration according to the service configuration information, wherein the receiving the verification information comprises:
receiving (S105), from an auxiliary configuration device, a uniform resource locator URL link sent by the network management device to the auxiliary configuration device, wherein a parameter of the URL link comprises the verification information;
characterized in that
the parameter of the URL link is encrypted, wherein:
the method further comprises pushing, to the auxiliary configuration device, a portal page to receive, from a user, an input of a decryption key on the portal page;
receiving, from the auxiliary configuration device, the decryption key, and
decrypting the received verification information based on the decryption key, wherein the registration request further comprises an identifier of the to-be-configured device; and the identifier of the to-be-configured device is used by the network management device to perform trustlist verification on the to-be-configured device; wherein the identifier is an equipment serial number, ESN, and a trustlist is a set of ESNs of devices supported by the network management device, wherein if the ESN of the to-be-configured device is in the trustlist, the trustlist verification is successful, and if the ESN of the to-be-configured device is not in the trustlist, the trustlist verification fails, wherein the service configuration information is received from the network management device after the to-be-configured device is successfully verified based on both the verification information and the identifier of the to-be-configured device.