A method and system for allocating isolation mechanisms for joint scheduling of multiple ranges

Abstract

The present invention discloses a method and system for allocating an isolation mechanism for joint scheduling of multiple ranges, the method comprising: classifying nodes and connections in a logical network topology diagram according to the range to which the nodes belong; for single range connections, aggregating according to the configuration of the switching equipment in the logical network topology diagram to generate a network; for cross-range connections, generating a network for each connection; for a single range network, allocating VLAN / VXLAN numbers from the divided single range number segments; for a cross-range network, allocating VLAN / VXLAN numbers from the divided cross-range number segments. The present invention divides VLAN / VXLAN number segments based on a single / multi-range mode, which can ensure the efficiency of allocation and solve the conflict problem. And by dividing the buffer number segments, the flexibility of allocation is further increased, and the probability of successful cross-range construction is improved.

Description

Technical Field

[0001] The invention relates to an isolation mechanism allocation method and system for joint scheduling of multiple shooting ranges, belonging to the technical field of network security. Background Art

[0002] The network range uses virtualization technology to simulate the real cyberspace attack and defense combat environment. It is a platform that supports various tests such as combat capability research and weapon equipment verification. As the scale of network security tests expands, higher requirements are placed on the simulation capabilities of the range. The traditional single range model has bottlenecks in performance and simulation scale, and it is necessary to support more complex network tests through joint simulation of multiple ranges.

[0003] When the method is expanded to multiple ranges for joint verification, each sub-range can be instantiated in the original way, and the isolation between different network topologies can be achieved through technologies such as VLAN or VXLAN. Links across ranges also use VLAN or VXLAN for communication, so as to achieve the purpose of interconnection of sub-range networks.

[0004] When a single range is expanded to multiple ranges, this approach faces the following problems (for ease of description, VLAN technology is used to describe it below): 1. In a single range, network isolation is performed through VLAN and other technologies, and each range assigns its own VLAN number to form a different network. However, when expanding from a single range to multiple ranges, if each range still assigns its own VLAN number, it may cause global VLAN conflicts, leading to network failure. 2. VLAN numbers need to be uniformly managed between multiple ranges, especially the VLAN numbers of network links connecting different ranges, to avoid conflicts. Summary of the invention

[0005] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide an isolation mechanism allocation method and system for joint scheduling of multiple shooting ranges, to achieve unified management of single shooting range and multi-shooting range modes, to ensure the efficiency of VLAN allocation, and to effectively solve the global VLAN conflict problem among multiple shooting ranges.

[0006] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0007] A method for allocating isolation mechanisms for joint scheduling of multiple ranges includes the following steps:

[0008] Classify the nodes in the logical network topology diagram according to the node belonging range;

[0009] Classify the connections in the logical network topology diagram according to the range to which the nodes belong, including single-range connections and cross-range connections;

[0010] For single range connections, aggregate them according to the configuration of switching devices in the logical network topology diagram to generate a network;

[0011] For cross-range connections, a network is generated for each connection;

[0012] For a single range network, a VLAN / VXLAN number is allocated from the divided single range number segment; the VLAN / VXLAN number in the single range number segment is multiplexed between different ranges;

[0013] For a cross-range network, a VLAN / VXLAN number is allocated from the divided cross-range number segment; the VLAN / VXLAN number of the cross-range number segment is globally unique.

[0014] Furthermore, when the VLAN / VXLAN numbers in the single-range number segment and / or the cross-range number segment are insufficient for allocation, the VLAN / VXLAN numbers are allocated from the divided buffer number segments.

[0015] Furthermore, when the number segments of a single shooting range are insufficient for allocation, each single shooting range in the logical network topology is traversed, the number of numbers that need to be allocated from the buffer segment for the single shooting range is calculated, and the maximum value is selected as the number of additional numbers that need to be applied for from the buffer segment for instantiation of the single shooting range.

[0016] Furthermore, when there are insufficient single-range number segments and / or cross-range number segments to be allocated during a logical network topology diagram instantiation, the total number of numbers that need to be additionally applied for from the buffer segment is determined. If the number of available numbers in the buffer segment is insufficient to support this instantiation, the instantiation process is terminated.

[0017] Furthermore, each single range locally maintains the VLAN / VXLAN numbers allocated from the single range number segment; the cross-range number segments and buffer number segments are allocated and maintained by the unified coordination center.

[0018] Preferably, the method for generating a network for connecting a single range includes:

[0019] If one end of the connection is a switch, if multiple networks are set on the switch, a network is generated based on the network set on the switch. If multiple networks are not set on the interactive machine, the terminal nodes connected to the same switch are aggregated into an abstract network.

[0020] If one end of the connection is a router, a separate network is generated for the connection.

[0021] Preferably, each time multiple ranges are instantiated, VLAN / VXLAN numbers are allocated in combination with single range number segments, cross-range number segments, and buffer number segments, and the steps include:

[0022] For each single shooting range, the number of elements num(Net_i) in the network set Net_i represents the number of VLAN IDs required for instantiation, and the number of remaining available VLAN IDs in the local area of the single shooting range is denoted as Left_i; if Left_i < num(Net_i), then the number of IDs to be allocated is denoted as Buffer_i = num(Net_i) - Left_i; otherwise Buffer_i = 0; Traverse each single shooting range and calculate the maximum value max(Buffer_i) as the number of VLAN IDs that need to be additionally applied from the buffer for the instantiation of multiple shooting ranges;

[0023] For cross-shooting ranges, the number of elements num(Net_external) in the network set Net_external is the number of VLAN IDs required for cross-shooting range interconnection, and the number of remaining available VLAN IDs for cross-shooting ranges in the unified coordination center is denoted as Left_v2; if Left_v2 < num(Net_external), then the number of IDs to be allocated is denoted as Buffer_external = num(Net_external) - Left_v2; otherwise Buffer_external = 0;

[0024] Denote the number of remaining available VLAN IDs in the buffer as Left_v3. If Left_v3 < Buffer_external + max(Buffer_i), then the currently available VLAN IDs are not sufficient to support instantiation, and the process is aborted; otherwise: The unified coordination center allocates max(Buffer_i) VLAN IDs in the buffer for use by single shooting ranges, allocates Buffer_external VLAN IDs in the buffer for cross-shooting range connection, and maintains the specific VLAN IDs allocated this time.

[0025] A multi-shooting range joint scheduling isolation mechanism allocation system, comprising:

[0026] A classification module, configured to classify the nodes in the logical network topology diagram according to the shooting range to which the nodes belong; and classify the connections in the logical network topology diagram according to the shooting range to which the nodes belong, including single shooting range connections and cross-shooting range connections;

[0027] A network generation module, configured to aggregate according to the switch device configuration in the logical network topology diagram to generate a network; and for cross-shooting range connections, generate a network for each connection;

[0028] The VLAN / VXLAN number allocation module is used to allocate VLAN / VXLAN numbers from the divided single-range number segments for a single-range network; the VLAN / VXLAN numbers in the single-range number segments are reused between different ranges; and for a cross-range network, allocate VLAN / VXLAN numbers from the divided cross-range number segments; the VLAN / VXLAN numbers of the cross-range number segments are globally unique.

[0029] Furthermore, the system also includes a buffer segment allocation module, which is used to allocate VLAN / VXLAN numbers from the divided buffer segments when the VLAN / VXLAN numbers in the single-range segment and / or the cross-range segment are insufficient.

[0030] A computer program product includes a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the steps of the isolation mechanism allocation method for joint scheduling of multiple shooting ranges are implemented.

[0031] Beneficial effects: Compared with the prior art, the present invention has the following advantages: 1. The present invention divides the VLAN / VXLAN segments based on the single target range and multi-target range modes. Each mode has its own specific segments. The segments of the single target range mode can be reused between different target ranges, and the segments of the multi-target range mode need to be guaranteed to be globally unique; this mode ensures the efficiency of VLAN / VXLAN allocation and effectively solves the global VLAN / VXLAN conflict problem between multiple target ranges. 2. The present invention further defines the VLAN / VXLAN buffer zone, which increases the flexibility of VLAN / VXLAN allocation. It can effectively reduce the starvation problem caused by the imbalance of VLAN / VXLAN allocation between a single target range and across target ranges, and improve the probability of successful construction across target ranges. 3. In the present invention, the cross-target range segments and buffer segments are allocated and maintained by a unified coordination center, and a unified storage mechanism is used to coordinate the VLAN / VXLAN information that needs to be shared between multiple target ranges, ensuring the synchronization of global VLAN / VXLAN information. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The flowchart of the allocation method for dividing single / cross-range number segments in an embodiment of the present invention is shown.

[0033] Figure 2 The flowchart is a method for allocating single / cross-range number segments and buffer number segments in an embodiment of the present invention.

[0034] Figure 3 Schematic diagram of multiple shooting range deployment in an embodiment of the present invention.

[0035] Figure 4 The figure is a flow chart of VLAN allocation in an embodiment of the present invention.

[0036] Figure 5 This is a multi-range logical network topology diagram exemplified in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0038] like Figure 1 As shown, an isolation mechanism (VLAN or VXLAN) allocation method for joint scheduling of multiple ranges disclosed in an embodiment of the present invention divides VLAN / VXLAN segments based on single range and multi-range modes. First, the nodes in the logical network topology diagram are classified according to the range to which the nodes belong, and the lines in the logical network topology diagram are classified according to the range to which the nodes belong. The line classification includes single range lines and cross-range lines. Then, for the single range lines, the switching device configuration in the logical network topology diagram is aggregated to generate a network. For the cross-range lines, a network is generated for each line. Finally, for the single range network, VLAN / VXLAN numbers are allocated from the divided single range segments, and the VLAN / VXLAN numbers in the single range segments are reused between different ranges. For the cross-range network, VLAN / VXLAN numbers are allocated from the divided cross-range segments. The VLAN / VXLAN numbers of the cross-range segments are globally unique.

[0039] Figure 2 The flowchart of the isolation mechanism allocation method for joint scheduling of multiple ranges disclosed in another embodiment of the present invention further improves the flexibility of allocation on the basis of the above embodiment. Taking VLAN as an example, the VLAN number segment is divided into three different number segments according to the usage mode: single range, cross-range, and buffer (such as single range segment V1=[1,3800], cross-range segment V2=[3801,3900], buffer segment V3=[3901,4094]); the single range segment is only allocated to the logical link within a single range, and the cross-range segment is only allocated to the logical link used across ranges. Different exercise modes have different requirements for single range / cross-range VLAN numbering, and the VLAN segment of the buffer can be used in both single range / cross-range modes. When the single range / cross-range segment is exhausted, the corresponding segment is allocated from the buffer.

[0040] In the embodiment of the present invention, when the single range number segment is insufficient to be allocated, each single range in the logical network topology is traversed, the number of numbers that need to be allocated from the buffer area number segment for the single range is calculated, and the maximum value is selected as the number of numbers that need to be additionally applied for from the buffer area number segment for the single range instantiation. When there are insufficient single range number segments and / or cross-range number segments to be allocated in a logical network topology instantiation, the total number of numbers that need to be additionally applied for from the buffer area number segment is determined. If the number of available numbers in the buffer area number segment is insufficient to support this instantiation, the instantiation process is terminated.

[0041] Regarding the storage method of VLAN numbers, it is recommended that a single range maintain the VLAN numbers used within the range;

[0042] A new unified coordination center is established, and the unified coordination center allocates and maintains the VLAN numbers allocated across the ranges / buffers.

[0043] The deployment mode of multiple ranges is as follows: Figure 3 As shown. Multiple ranges are deployed horizontally, and the connectivity between logical networks is controlled by the interconnection system. Based on VLAN / VXLAN tunnel technology, the interconnection system spans multiple ranges. When the sub-ranges need logical link connection, they only need to set the same VLAN number on the local end of the interconnection system. The VLAN numbers used for cross-range connection between multiple ranges are stored in the unified coordination center.

[0044] Combine the following Figure 4 The VLAN assignment process shown and Figure 5 The example of the multi-range logical network topology diagram shown in the figure is used to exemplarily illustrate the isolation mechanism allocation method for the multi-range joint scheduling of an embodiment of the present invention, and the specific steps include:

[0045] Step 1: For the logical network topology diagram, according to the different ranges of the nodes, split it into multiple independent node subsets Node_i. Figure 5 In the network shown, ABC belongs to range S1, DMF belongs to range S2, and GKH belongs to range S3. The node subset after splitting is Node={Node_S1, Node_S2, Node_S3}, where Node_S1={A,B,C}, Node_S2={D,M,F}, Node_S3={G,K,H}.

[0046] Step 2: For the connections between nodes in the logical network topology diagram, according to the different target ranges to which the port nodes at both ends belong, they are split into multiple independent connection subsets, including the subset Edge_internal_i within a single target range and the cross-target range set Edge_external. Figure 5In the example shown, Edge_internal={Edge_internal_S1, Edge_internal_S2, Edge_internal_S3}. Among them, Edge_internal_S1={A1-C1,B1-C2}, Edge_internal_S2={D2-M1,D3-F1}, Edge_internal_S3={G2-K1,G4-H1}; Edge_external={C3-G1,D1-G3}.

[0047] Step 3: For the subset of connections in a single range, aggregate them according to the configuration of the switching devices in the logical network topology diagram to generate a network. Determine whether the terminal nodes corresponding to each connection belong to the same network segment. If they belong to the same network segment, aggregate them into an abstract network; otherwise, generate a separate network. The network set obtained for each single range is recorded as Net_i.

[0048] For the single target range S1, A1-C1, B1-C2 in Edge_internal_S1 represent the connection from point C to A and B, where the device types of A and B are terminals and C is a switch. First, obtain the network configuration information of the switch to determine whether the user has set up multiple networks on the switch. If the user has divided the switch into multiple networks (such as Netx, Nety, Netz), Net_S1={Netx, Nety, Netz} can be derived from Edge_internal_S1; otherwise, referring to the rules of the physical world, all terminals connected to the switch are assumed to be in the same network, and Net_S1={Nab} can be derived from Edge_internal_S1, where Nab indicates that nodes A and B belong to the same network.

[0049] For the single range S2, D2-M1 and D3-F1 in Edge_internal_S2 represent the connection from point D to M and F. If M and F do not belong to the same network in the logical network planning (for example, D is a router), Edge_internal_S2 can derive Net_s2={Ndm,Ndf}, where Ndm represents the subnet network of the D2-M1 link and Ndf represents the subnet network of the D3-F1 link.

[0050] Step 4. For the subset of connections Edge_external across the target ranges, each element in the set represents a network. For the example of Edge_external = {C3 - G1, D1 - G3}, the generated network set is denoted as Net_external = {Ncg, Ndg}. Among them, Ncg represents the subnet network of the C3 - G1 link, and Ndg represents the subnet network of the D1 - G3 link.

[0051] Step 5. For each single target range, the number of elements num(Net_i) in the Net_i set represents the number of VLAN numbers required for instantiation. The remaining available VLAN numbers in the single target range locally are denoted as Left_i. If Left_i < num(Net_i), it means that the single target range needs to allocate additional VLAN numbers from the buffer, and the number of numbers to be allocated Buffer_i = num(Net_i) - Left_i; otherwise, Buffer_i = 0.

[0052] Step 6. Traverse each single target range, and max(Buffer_i) is the number of VLAN numbers that need to be additionally applied from the buffer for this multi - target range instantiation.

[0053] Step 7. For the networks across the target ranges, num(Net_external) is the number of VLAN numbers required for cross - target range interconnection. The remaining available VLAN numbers for cross - target ranges in the unified coordination center are denoted as Left_v2. If Left_v2 < num(Net_external), it means that additional VLAN numbers need to be obtained from the buffer, and the number of numbers to be allocated Buffer_external = num(Net_external) - Left_v2; otherwise, Buffer_external = 0.

[0054] Step 8. Denote the remaining available VLAN numbers in the buffer as Left_v3. If Left_v3 < Buffer_external + max(Buffer_i), the currently available VLAN numbers are not sufficient to support the instantiation, and the process is aborted; otherwise, jump to Step 9.

[0055] Step 9. The unified coordination center allocates max(Buffer_i) VLAN numbers in the buffer for the single target ranges to use and maintains the specific VLAN numbers allocated this time; the unified coordination center allocates Buffer_external VLAN numbers in the buffer for cross - target range connection to use and maintains the specific VLAN numbers allocated this time.

[0056] Step 10. Each single target range locally maintains the VLAN numbers allocated from the single target range number segment V1.

[0057] Step 11: Each element in Net_i and Net_external sets a VLAN for each network from the VLAN numbers allocated in steps 9 and 10, for isolation between different networks.

[0058] Step 12, the single range instantiates the scenario according to the VLAN number allocated from the local,buffer.

[0059] Step 13: After the instantiation of a single range is completed, the data channel between the ranges is opened according to the VLAN number of the range.

[0060] Based on the same inventive concept, the embodiment of the present invention also discloses a system for allocating isolation mechanisms for joint scheduling of multiple ranges, including: a classification module for classifying nodes in a logical network topology diagram according to the range to which the nodes belong; and, classifying the connections in the logical network topology diagram according to the range to which the nodes belong, including single range connections and cross-range connections; a network generation module for aggregating and generating a network according to the configuration of the switching equipment in the logical network topology diagram; and, for cross-range connections, each connection generates a network; a VLAN / VXLAN number allocation module for allocating VLAN / VXLAN numbers from the divided single range number segments for a single range network; the VLAN / VXLAN numbers in the single range number segments are reused between different ranges; and, for a cross-range network, VLAN / VXLAN numbers are allocated from the divided cross-range number segments; the VLAN / VXLAN numbers of the cross-range number segments are globally unique. The system can be set in a unified coordination center to implement an isolation mechanism allocation method for joint scheduling of multiple ranges. Furthermore, the system also includes a buffer segment allocation module, which is used to allocate VLAN / VXLAN numbers from the buffer segment when the VLAN / VXLAN numbers in the single-range segment and / or the cross-range segment are insufficient.

[0061] Based on the same inventive concept, an embodiment of the present invention also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the isolation mechanism allocation method for joint scheduling of multiple target ranges.

Claims

1. A method for allocating isolation mechanisms for joint scheduling of multiple ranges, characterized in that: It includes the following steps: Classify the nodes in the logical network topology diagram according to the target ranges to which the nodes belong; Classify the connections in the logical network topology diagram according to the target ranges to which the nodes belong, including single-target-range connections and cross-target-range connections; For single-target-range connections, aggregate them according to the switch device configuration in the logical network topology diagram to generate a network; For cross-target-range connections, generate a network for each connection; For the networks of single target ranges, allocate VLAN / VXLAN numbers from the allocated single-target-range number segments; the VLAN / VXLAN numbers in the single-target-range number segments are reused among different target ranges; For the networks of cross target ranges, allocate VLAN / VXLAN numbers from the allocated cross-target-range number segments; the VLAN / VXLAN numbers in the cross-target-range number segments are globally unique.

2. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 1 is characterized in that: When the VLAN / VXLAN numbers in the single-target-range number segments and / or cross-target-range number segments are insufficient for allocation, allocate VLAN / VXLAN numbers from the allocated buffer number segments.

3. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 2 is characterized in that: When the single-target-range number segments are insufficient for allocation, traverse each single target range in the logical network topology diagram, calculate the number of numbers that need to be allocated from the buffer number segments for each single target range, and select the maximum value as the number of numbers that need to be additionally applied from the buffer number segments for the instantiation of the single target range.

4. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 2 is characterized in that: When the single-target-range number segments and / or cross-target-range number segments are insufficient for allocation during the instantiation of a logical network topology diagram once, judge the total number of numbers that need to be additionally applied to the buffer number segments. If the available number of numbers in the buffer number segments is not enough to support this instantiation, the instantiation process is aborted.

5. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 2 is characterized in that: Each single target range locally maintains the VLAN / VXLAN numbers allocated from the single-target-range number segments; the cross-target-range number segments and buffer number segments are allocated and maintained by a unified coordination center.

6. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 1 is characterized in that: The method for generating a network for single-target-range connections includes: If one end of the connection is a switch, if multiple networks are set on the switch, generate a network according to the networks set on the switch. If multiple networks are not set on the switch, aggregate the terminal nodes connected to the same switch into an abstract network; If one end of the connection is a router, generate a separate network for the connection.

7. The isolation mechanism allocation method for joint scheduling of multiple shooting ranges according to claim 2 is characterized in that: Each time a multi-target range is instantiated, allocate VLAN / VXLAN numbers in combination with the single-target-range number segments, cross-target-range number segments, and buffer number segments. The steps include: For each single target range, the number of elements num(Net_i) in the network set Net_i represents the number of VLAN numbers required for instantiation, and the remaining available VLAN numbers locally in the single target range are denoted as Left_i; if Left_i < num(Net_i), then denote the number of numbers to be allocated as Buffer_i = num(Net_i) - Left_i; otherwise Buffer_i = 0; traverse each single target range, and calculate the maximum value max(Buffer_i) as the number of VLAN numbers that need to be additionally applied from the buffer for this multi-target-range instantiation; For the cross-range, the number of elements num(Net_external) in the network set Net_external is the number of VLAN numbers required for cross-range interconnection and communication. The remaining available VLAN numbers for the unified coordination center across ranges are denoted as Left_v2; if Left_v2 < num(Net_external), then the number of numbers to be allocated is denoted as Buffer_external = num(Net_external) - Left_v2; otherwise, Buffer_external = 0; Denote the remaining available VLAN numbers in the buffer as Left_v3. If Left_v3 < Buffer_external + max(Buffer_i), then the currently available VLAN numbers are not sufficient to support instantiation, and the process is aborted; otherwise: the unified coordination center allocates max(Buffer_i) VLAN numbers in the buffer for single-range use, allocates Buffer_external VLAN numbers in the buffer for cross-range connection, and maintains the specific VLAN numbers allocated this time.

8. An isolation mechanism allocation system for joint scheduling of multiple shooting ranges, characterized in that: Including: A classification module for classifying the nodes in the logical network topology diagram according to the range to which the nodes belong; And classifying the connections in the logical network topology diagram according to the range to which the nodes belong, including single-range connections and cross-range connections; A network generation module for aggregating according to the switch device configuration in the logical network topology diagram to generate a network; And for each cross-range connection, generating a network; A VLAN / VXLAN number allocation module for allocating VLAN / VXLAN numbers from the allocated single-range number segment for the single-range network; the VLAN / VXLAN numbers in the single-range number segment are reused among different ranges; and for the cross-range network, allocating VLAN / VXLAN numbers from the allocated cross-range number segment; the VLAN / VXLAN numbers in the cross-range number segment are globally unique.

9. The isolation mechanism allocation system for joint scheduling of multiple shooting ranges according to claim 8, characterized in that: It further includes a buffer number segment allocation module for allocating VLAN / VXLAN numbers from the allocated buffer number segment when the VLAN / VXLAN numbers in the single-range number segment and / or cross-range number segment are not enough for allocation.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the allocation method of an isolation mechanism for multi-range joint scheduling according to any one of claims 1-7 are implemented.

Images