Communication method

Abstract

The embodiment of the invention provides a communication method, a communication system, electronic equipment, a storage medium and a program product. The communication method includes receiving port resource configuration information from a network controller in a software defined wide area network (SD-WAN). The port resource configuration information is used for establishing a security management tunnel between an edge node in the SD-WAN and an associated routing reflector (RR) in the SD-WAN, and the edge node sends a security management tunnel establishment request to the RR. The security management tunnel establishment request comprises a port number in the port resource configuration information. And the edge node establishes a security management tunnel with the RR based on the port number. According to the embodiment of the invention, excessive manual intervention can be reduced, and the operation cost is reduced.

Description

Technical Field

[0001] The embodiments of the present disclosure generally relate to the field of communication technology. More specifically, the embodiments of the present disclosure relate to a communication method, a communication system, an electronic device, a computer-readable storage medium, and a computer program product for controlling and managing port adaptive network flow control of a software-defined wide area network (SD-WAN). Background Art

[0002] Digitalization and globalization have made it difficult for enterprise branch sites to achieve fast and interconnected access to more diverse operator networks in a wider area. At the same time, as the deployment of enterprise services in the cloud intensifies in the next few years, traditional branches, headquarters and data centers (DCs) of enterprises need to be more open and flexible to connect to the Internet, public clouds and software operating services (SaaS) applications. Under the new situation, how to efficiently and quickly realize the multi-cloud and multi-network interconnection of enterprise wide area networks (WANs) and carry the interconnection demands of large and complex organizations and businesses of enterprises has become the key to whether enterprises can successfully complete digital transformation. Traditional enterprise-to-enterprise interconnection generally uses multi-label switching (MPLS) dedicated lines, but MPLS dedicated lines have problems such as high cost of use, long deployment cycle and difficult troubleshooting. Against this background, software-defined wide area networks (SD-WANs) have emerged.

[0003] SD-WAN is an application branch of software-defined networking (SDN). It is the application of SDN technology in the WAN field. It is built on the traditional Internet and MPLS dedicated lines to automatically realize the overlay network of interconnection between enterprises. SD-WAN is a low-cost and highly flexible wide area network solution that can be quickly deployed. After using SD-WAN, users no longer need to care about the type of WAN port network used (MPLS, xSDL, fiber broadband, fourth-generation communication network (4G), fifth-generation communication network (5G) and other connection types). SD-WAN binds them together and autonomously selects different optimal paths for different applications based on network conditions and policy configurations. Summary of the invention

[0004] The embodiments of the present disclosure provide a technical solution for software defined wide area network (SD-WAN) control management port adaptive network flow control. The embodiments of the present disclosure send port resource configuration information to edge nodes through the network controller in the SD-WAN, and establish a secure management tunnel between the port resource configuration information and the RR, which can reduce excessive manual intervention and reduce operating costs.

[0005] In a first aspect of the present disclosure, a communication method is provided. The method includes: receiving port resource configuration information from a network controller in a software-defined wide area network (SD-WAN). The port resource configuration information is used to establish a security management tunnel between an edge node in the SD-WAN and an associated route reflector (RR) in the SD-WAN. And the edge node sends a security management tunnel establishment request to the RR. The security management tunnel establishment request includes the port number in the port resource configuration information. And the edge node establishes a security management tunnel with the RR based on the port number. Thus, the edge node can establish a security management tunnel with the port information sent by the network controller through the RR.

[0006] In some embodiments of the first aspect, wherein the port number is a first port number, the method further comprises: in response to the edge node not receiving a response from the RR within a predetermined period, determining a second port number in the port resource configuration information by a preconfigured step length in the port resource configuration information; and establishing a security management tunnel with the RR based on the second port number. Thus, the edge node can autonomously adjust the port number.

[0007] In some embodiments of the first aspect, the method further comprises: in response to failure to successfully establish the secure management tunnel after reaching a predetermined number of attempts in the port resource configuration information, the edge node sending feedback information to the network controller; and receiving additional port resource configuration information from the network controller to retry establishing the secure management tunnel. Thus, the edge node can update the pre-configured port information.

[0008] In some embodiments of the first aspect, determining the second port number by a preconfigured step size includes: determining the second port by incrementing or decrementing the port resource configuration information by a preconfigured step size. Thus, the edge node can adjust the port number used to establish the security management tunnel.

[0009] In some embodiments of the first aspect, wherein the port number is a first port number, and the security management tunnel is a first security management tunnel, the method further comprises: sending a port change request to the controller. The port change request comprises a second port number in the port resource configuration information and an identifier of the first security management tunnel; and establishing a second security management tunnel with the RR based on the second port number. Thus, the edge node notifies the controller of the port change.

[0010] In some embodiments of the first aspect, the method further includes: after the second security management tunnel is established, closing the first security management tunnel, thereby achieving the switching of the security management tunnel.

[0011] In some embodiments of the first aspect, the method further includes: sending the port number and the identifier of the edge node to the network controller, whereby the edge node notifies the network controller of the port information.

[0012] In some embodiments of the first aspect, the method further comprises: in response to not receiving a response from the RR within a predetermined period, sending a negotiation request to the network controller. The negotiation request includes an identifier of the edge node and a negotiation port number range. And receiving updated port resource configuration information from the network controller; and establishing a first security management tunnel with the RR based on the updated port resource configuration information. Thus, the edge node can negotiate port information with the network controller and update the port information.

[0013] In a second aspect of the present disclosure, a communication system is provided. The system includes: a network controller in an SD-WAN, configured to determine port resource configuration information. The port resource configuration information includes a port number for establishing a secure management tunnel between an edge node in the SD-WAN and an RR in the SD-WAN; an edge node, configured to receive the port resource configuration information from the network controller and establish a secure management tunnel with the RR; and the RR, configured to receive the port resource configuration information from the network controller and establish a secure management tunnel with the edge node. Thus, the edge node can establish a secure management tunnel with the RR through the port information sent by the network controller.

[0014] In some embodiments of the second aspect, wherein the port number is a first port number, the edge node is further configured to: in response to not receiving a response from the RR within a predetermined period, determine a second port number in the port resource configuration information by a preconfigured step size in the port resource configuration information; and establish a security management tunnel with the RR based on the second port number. Thus, the edge node can autonomously adjust the port number.

[0015] In some embodiments of the second aspect, the edge node is further configured to: in response to failure to successfully establish a secure management tunnel after reaching a predetermined number of attempts in the port resource configuration information, send feedback information to the network controller; and receive additional port resource configuration information from the network controller to retry establishing the secure management tunnel. Thus, the edge node can update the pre-configured port information.

[0016] In some embodiments of the second aspect, the edge node is further configured to determine the second port number by increasing or decreasing the port resource configuration information in a preconfigured step size, so that the edge node can adjust the port number used to establish the security management tunnel.

[0017] In some embodiments of the second aspect, the port number is a first port number, and the security management tunnel is a first security management tunnel. The edge node is further configured to: send a port change request to the controller. The port change request includes a second port number in the port resource configuration information and an identifier of the first security management tunnel; and establish a second security management tunnel with the RR based on the second port number. Thus, the edge node notifies the controller of the change of the port.

[0018] In some embodiments of the second aspect, the edge node is further configured to: close the first security management tunnel after the second security management tunnel is established, thereby achieving the switching of the security management tunnel.

[0019] In some embodiments of the second aspect, the edge node is further configured to: send the port number and the identifier of the edge node to the network controller, so that the edge node notifies the network controller of the port information.

[0020] In some embodiments of the second aspect, the edge node is further configured to: in response to not receiving a response from the RR within a predetermined period, send a negotiation request to the network controller. The negotiation request includes an identifier of the edge node and a negotiation port number range. Receive updated port resource configuration information from the controller. And establish a first security management tunnel with the RR based on the updated port resource configuration information. Thus, the edge node can negotiate port information with the network controller and update the port information.

[0021] In a third aspect of the present disclosure, an electronic device is provided, comprising: at least one computing unit; and at least one memory, the at least one memory being coupled to the at least one computing unit and storing instructions for execution by the at least one computing unit, the instructions, when executed by the at least one computing unit, causing the device to execute a method according to the first aspect.

[0022] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, storing a computer program, and when the program is executed by a processor, the method according to the first aspect is implemented.

[0023] In a fifth aspect of the present disclosure, a computer program product is provided, comprising computer executable instructions, which, when executed by a processor, cause a device to perform the method according to the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0025] Figure 1A schematic diagram illustrating an example environment in which various embodiments of the present disclosure can be implemented;

[0026] Figure 2 A schematic diagram showing a communication process according to some embodiments of the present disclosure;

[0027] Figure 3 A schematic diagram showing a communication process according to some embodiments of the present disclosure is shown;

[0028] Figure 4 A schematic diagram showing another communication process according to some embodiments of the present disclosure;

[0029] Figure 5 A flow chart showing a communication method according to some embodiments of the present disclosure is shown;

[0030] Figure 6 A block diagram of an electronic device capable of implementing various embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0031] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0032] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0033] In traditional networks, Internet Protocol Security (IPSEC) encryption has proven itself to be a key encryption technology for enterprise internal services to safely traverse the operator's black box network. In the SD-WAN solution, before each distributed service gateway establishes an IPSEC service encryption tunnel, each distributed component needs to traverse the operator's black box network, such as a temporary tunnel of Datagram Transport Layer Security (DTLS) for authentication and interactive docking parameters between the site and the regional controller, and through the NAT UDP Simple Traversal (STUN) technology, it is possible to detect whether the site is deployed under the NAT gateway.

[0034] Currently, SD-WAN deployment scenarios need to traverse the operator's Internet network. Some operators will block the service flows of well-known ports such as IPSEC, DTLS, and STUN, resulting in the inability to negotiate the control channel of the SD-WAN site normally, traverse NAT, and automatically deploy. This will affect the establishment of all subsequent SD-WAN control and service IPSEC encryption channels.

[0035] Therefore, SD-WAN uses the operator's black box Internet networking WAN line to build an overlay tunnel for enterprise branch interconnection. When the site establishes a link with the regional controller, the special port is filtered by the operator's network blacklist and the traffic is discarded in the operator's network. As a result, the network cannot normally establish control and business channels, and cannot perceive the gateway under the NAT gateway. Network automation networking cannot be carried out, which seriously affects the normal business between sites.

[0036] Traditional SD-WAN technology can only manually intervene to modify the DTLS negotiation port and STUN port. If the site cannot establish business normally, it takes a long time to locate and complicated troubleshooting methods. Through layer-by-layer troubleshooting, it is found that the site was blocked by the operator during the early negotiation. This requires relying on operation and maintenance personnel with certain IT skills, resulting in a large amount of operation and maintenance costs (OPEX). The business flows involving well-known ports in the SD-WAN system components mainly include RR control channels (involving DTLS, STUN, etc.) and Overlay encrypted business channels (dynamically acquired). In order to reduce the intervention of operation and maintenance personnel, it is hoped that there is a method that can enable the system to automatically complete the control negotiation ports involved to adapt to each other and achieve customer insensitivity to the greatest extent.

[0037] In view of this, the embodiments of the present disclosure specifically propose a solution. In some example aspects, the solution of the embodiments of the present disclosure increases the carrying of DTLS port negotiation parameters when the edge node and the RR site DTLS are established, and automatically attempts port negotiation when STUN is detected, thereby reducing the cost of manual intervention in customer operation and maintenance. The solution of the embodiments of the present disclosure implements dynamic negotiation management of DTLS and STUN docking parameters, which is particularly suitable for existing network scenarios with a large number of operators, a wide range of branch physical locations, multi-branch wide-area branch interconnection, and insufficient customer operation and maintenance personnel. Therefore, the dynamic detection and negotiation solution can decouple this solution from the operator's operating environment and reduce excessive manual intervention.

[0038] Figure 1 Schematic diagram of an example environment in which various embodiments of the present disclosure can be implemented. Figure 1As shown, the example environment includes edge nodes 101 and 102, RR / STUN server 103 and network controller 104. Edge node 101 is located at the headquarters station. Edge node 102 is located at the branch station. There is a management channel over SSH between network controller 104 and edge nodes 101 and 102. There is an Ethernet virtual private network (EVPN) pipe between edge node 101 and RR103, which has a DTLS channel as a control channel. There is transmission of STUN binding request and STUN binding response messages between edge node 102 and STUN server 103. There is a generic routing encapsulation (GRE) or GRE on IPSEC as a data channel between edge node 101 and edge node 102. Edge node 102 can also be connected to a third-party security gateway on the public cloud via IPSEC.

[0039] Figure 2 FIG. 1 is a schematic diagram showing a communication process according to some embodiments of the present disclosure. Figure 2 As shown, the edge node 101 receives 203 port resource configuration information 202 from the network controller 104. The port resource configuration information is used to establish a security management tunnel between the edge node 101 and the associated RR 103. And the edge node 101 sends 204 a security management tunnel establishment request 205 to the RR 103. The security management tunnel establishment request 205 includes the port number in the port resource configuration information. And the edge node 101 establishes a security management tunnel 208 with the RR 103 based on the port number.

[0040] When the DTLS is established through the edge node 101 and the RR 103, the DTLS port negotiation parameter is added, and the port negotiation attempt is automatically performed, which reduces the cost of manual intervention of customer operation and maintenance. Therefore, the above method can shield the port blacklist restrictions of the operator's black box network and simplify the complexity of commissioning and configuration.

[0041] Figure 3 FIG. 1 is a schematic diagram showing a communication process according to some embodiments of the present disclosure. Figure 3As shown, the network controller 104 configures the port resource segment of DTLS and the port resource segment of STUN. Specifically, the network controller 104 defines the global DTLS port resource end, and sets the default port value, as well as the step size and number of attempts for future attempts. The network controller 104 also defines the global STUN port resource segment, and sets the default port value, as well as the step size and number of attempts for future attempts. Then, the network controller 104 sends the configuration 301 to RR103 and the associated edge nodes 101 and 102. Specifically, after RR103 goes online, the network controller 104 sends the well-known port global parameters (DTLS, STUN). After the edge node 101 goes online, the network controller 104 sends the well-known port to the edge node 101.

[0042] In some embodiments, the edge node 101 initiates a control channel establishment process to RR103. Specifically, the edge node 102 initiates 302 a DTLS establishment request to RR103 to establish a temporary DTLS tunnel. During this interaction, the edge node 101 carries DTLS related parameters to RR103. When RR103 receives the DTLS message from the edge node 101, it finds the port number carried and establishes a DTLS temporary tunnel using this port.

[0043] In some embodiments, if the edge node 101 does not receive a response from RR103 within a predetermined period, the second port number is determined in the port resource configuration information through the pre-configured step size in the port resource configuration information, and a security management tunnel with RR103 is established based on the second port number. Specifically, within a certain period of time, the edge node 101 automatically polls and attempts to establish a control channel with RR103. If there is no response within the period, the edge node 101 will increase or decrease the step size set previously, and retry to establish a temporary tunnel with RR103. When the connection is successfully established, RR103 records the negotiation port this time, and the subsequent edge node 101 also uses this port to establish a connection. At the same time, RR103 will report the port of the control channel to the network controller 104, and the subsequent edge node will give priority to the port negotiation when issuing.

[0044] In some embodiments, if the edge node 101 fails to successfully establish a secure management tunnel after reaching a predetermined number of attempts in the port resource configuration information, the edge node 101 sends feedback information to the network controller 104 and receives additional port resource configuration information from the network controller 104 to retry to establish the secure management tunnel. Specifically, if the number of attempts reaches an upper limit, the edge node 101 and RR103 can feedback 304 the result of the attempt to the network controller 104 to notify the administrator to manually specify a special port and retry. The administrator manually specifies the port and sends it to RR103 and the edge node 101. The edge node 101 and RR103 retry the DTLS negotiation to support the establishment of subsequent control channels.

[0045] In some embodiments, after DTLS is normally established, the edge node 102 attempts to traverse NAT and negotiate with the STUN server 103. When the edge node 102 attempts to use a well-known port for negotiation and finds that the controller channel cannot be established normally, the edge node 102 attempts to perform STUN port traversal, increasing and decreasing according to the agreed random value, and retrying. Specifically, the edge node 102 and RR103 try to use the default STUN port for detection. Specifically, the edge node 102 initiates a 304STUN request to RR103. If RR103 does not respond within the cycle, the edge node 102 will increase or decrease the port within the set port resources to retry to initiate a STUN request with RR103 until the interaction is successful. When the number of attempts of the edge node 102 reaches the upper limit, the edge node 102 feeds back the result of the attempt to the network controller 104 to notify the administrator to manually specify a special port and try again.

[0046] The above method reduces the cost of manual intervention of customer operation and maintenance by automatically performing port negotiation attempts. Specifically, the dynamic negotiation management of DTLS and STUN docking parameters is particularly suitable for the situation where there are a large number of existing network operators, a wide range of branch physical locations, multi-branch wide-area branch interconnection scenarios, and insufficient customer operation and maintenance personnel. The above dynamic detection and negotiation scheme can decouple this scheme from the operator's operating environment and reduce excessive manual intervention.

[0047] Figure 4 A schematic diagram of another communication process according to some embodiments of the present disclosure is shown. Figure 4 As shown, after the SD-WAN device (for example, edge nodes 101 and 101, RR103) goes online, it will establish a normal management channel with the network controller 104. The controller side pre-sets the negotiation port range in advance. If the port range is changed, the controller will send 401 to the device. Then, the device refreshes the local negotiation port table entry.

[0048] In some embodiments, the devices at both ends of the DTLS and STUN protocols need to use a consistent port selection mechanism. In the case where the port range is blocked, the devices at both ends will try to use the preset port to connect. If the connection fails, they will initiate a request to the controller to obtain an available port. When one of the devices needs to change the port used, it will first send a port change request to the network controller 104, and the request includes the new port number and the identifier of the current connection.

[0049] In some embodiments, after receiving the request, the controller first checks whether the identifier in the request is valid, and if so, stores the new port number and identifier in the database. The controller 104 sends a message to the other end device (such as RR103) to inform it that the port number of the connection has changed. The message contains the identifier of the current connection and the new port number. After receiving the message, the other end device first checks whether the identifier in the message is valid, and if so, updates the port number of the connection. If both parties use the request mechanism for port change, the other end device can also send a request through the network controller 104 when changing the port, so as to ensure the synchronization of the port status of both parties.

[0050] In some embodiments, to prevent connection interruption, the devices at both ends may open a new port before changing the port, establish a new connection on the new port, wait for the old connection to be closed, and then switch to the new port for communication. For better port management, the network controller 104 may provide an interface to allow the devices at both ends to query the currently available port number and status.

[0051] In some embodiments, after the device selects the port to be enabled this time, it feeds back to the network controller 104. The network controller 104 notifies RR103 that the negotiation request message contains information such as the device identifier and the attempted port. Then, the device attempts to establish a 403 temporary DTLS connection with the RR to which it belongs and to establish a 405 STUN detection connection. If the operator blocks the corresponding port for this attempt, the connection will fail. After the SD-WAN device fails to attempt and times out, a 402 negotiation request is sent to the network controller 104 to request an available port. The negotiation request includes parameters such as the device identifier and the negotiation port range. Then, the network controller 104 selects one or a group of available ports according to the agreed rule mechanism, and returns the port information 404 to the devices at both ends. After the SD-WAN device and RR103 receive the response from the controller, they use the returned port information to try to establish a connection.

[0052] In some embodiments, the SD-WAN device and RR103 are successfully established using DTLS, and after detecting their respective NAT public network addresses and public network port number parameter information through STUN, the SD-WAN device knows its own NAT environment, laying the foundation for subsequently establishing a normal encrypted overlay tunnel with other SD-WAN devices.

[0053] The above method uses a strong coupling mode between the device and the controller, and all synchronization attempts are confirmed by the network controller 104. After synchronization, the devices at both ends attempt to establish a channel. The above method reduces the cost of manual intervention of customer operation and maintenance, and is suitable for the situation where there are a large number of existing network operators, a wide range of branch physical locations, multi-branch wide-area branch interconnection scenarios, and insufficient customer operation and maintenance personnel.

[0054] Figure 5 A flow chart of a communication method according to some embodiments of the present disclosure is shown. In box 510, port resource configuration information is received from a network controller in the SD-WAN. The port resource configuration information is used to establish a secure management tunnel between an edge node in the SD-WAN and an associated RR in the SD-WAN. In box 520, the edge node sends a secure management tunnel establishment request to the RR. The secure management tunnel establishment request includes the port number in the port resource configuration information. In box 530, the edge node establishes a secure management tunnel with the RR based on the port number.

[0055] In some embodiments, where the port number is a first port number, the method further includes: the edge node determines a second port number in the port resource configuration information by a preconfigured step size in the port resource configuration information in response to not receiving a response from the RR within a predetermined period; and establishes a security management tunnel with the RR based on the second port number. Thus, the edge node can autonomously adjust the port number.

[0056] In some embodiments, the method further includes: in response to the failure to successfully establish the secure management tunnel after reaching a predetermined number of attempts in the port resource configuration information, the edge node sends feedback information to the network controller; and receives additional port resource configuration information from the network controller to retry to establish the secure management tunnel. Thus, the edge node can update the pre-configured port information.

[0057] In some embodiments, determining the second port number by a preconfigured step size includes: determining the second port by increasing or decreasing the port resource configuration information by a preconfigured step size. Thus, the edge node can adjust the port number used to establish the security management tunnel.

[0058] In some embodiments, the port number is a first port number, the security management tunnel is a first security management tunnel, and the method further includes: sending a port change request to the controller. The port change request includes the second port number in the port resource configuration information and the identifier of the first security management tunnel; and establishing a second security management tunnel with the RR based on the second port number. Thus, the edge node notifies the controller of the port change.

[0059] In some embodiments, the method further includes: after the second security management tunnel is established, closing the first security management tunnel, thereby achieving the switching of the security management tunnel.

[0060] In some embodiments of the first aspect, the method further includes: sending the port number and the identifier of the edge node to the network controller, whereby the edge node notifies the network controller of the port information.

[0061] In some embodiments, the method further includes: in response to not receiving a response from the RR within a predetermined period, sending a negotiation request to the network controller. The negotiation request includes an identifier of the edge node and a negotiated port number range. And receiving updated port resource configuration information from the network controller; and establishing a first security management tunnel with the RR based on the updated port resource configuration information. Thus, the edge node can negotiate port information with the network controller and update the port information.

[0062] Figure 6 1 is a block diagram of an electronic device 600 capable of implementing various embodiments of the present disclosure. The device 600 may be used to implement the following embodiments: Figure 1 The edge nodes 101 and 102 are shown. Figure 6 As shown, device 600 includes one or more processors (or processing units) 610 , may further include one or more memories 620 coupled to processor 610 , and may further include a communication interface 640 coupled to processor 610 .

[0063] The communication interface 640 may be used to communicate with other devices or apparatuses, such as the transmission or reception of data and / or signals. The communication interface 640 may have at least one communication interface for communication. The communication interface may include any interface necessary for communicating with other devices. Exemplarily, the communication interface may be a transceiver, a circuit, a bus, a module, or other types of communication interfaces.

[0064] Processor 610 may include, but is not limited to, at least one of the following: a general-purpose computer, a special-purpose computer, a microcontroller, a digital signal controller (DSP), or one or more of a controller-based multi-core controller architecture. Device 600 may have multiple processors, such as application-specific integrated circuit chips, which are time-dependent and synchronized with a clock of a main processor.

[0065] The memory 620 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, at least one of the following: read-only memory (ROM) 624, erasable programmable read-only memory (EPROM), flash memory, hard disk, compact disc (CD), digital video disk (DVD), or other magnetic storage and / or optical storage. Examples of volatile memories include, but are not limited to, at least one of the following: random access memory (RAM) 622, or other volatile memories that do not persist during the duration of a power outage.

[0066] Computer program 630 includes computer executable instructions executed by associated processor 610. Program 630 may be stored in ROM 620. Processor 610 may perform any suitable actions and processes by loading program 630 into RAM 620.

[0067] The program 630 can be used to implement the possible implementation of the present application, so that the device 600 can execute the following steps: Figure 5 Any process discussed. Possible implementations of the present application may also be implemented by hardware or by a combination of software and hardware.

[0068] In some implementations, the program 630 may be tangibly embodied in a computer-readable medium that may be included in the device 600 (such as in the memory 620) or other storage device accessible by the device 600. The program 630 may be loaded from the computer-readable medium to the RAM 622 for execution. The computer-readable medium may include any type of tangible non-volatile memory, such as ROM, EPROM, flash memory, hard disk, CD, DVD, etc.

[0069] It should be noted that the above embodiments are some implementation methods provided by this application, which are only for the purpose of more clearly illustrating the technical solution of this application, and do not limit other embodiments of this application. In other embodiments, more or fewer processes or steps, more or fewer components, more or fewer service functions, different scheduling strategies, etc. may also be included, which are not limited here. It is known to those of ordinary skill in the art that with the evolution of network architecture and the emergence of new business scenarios, the technical solution provided by this application is also applicable to solving similar technical problems.

[0070] The embodiment of the present application also provides a chip, which may include an input interface, an output interface and a processing circuit. In the embodiment of the present disclosure, the input interface and the output interface may complete the interaction of signaling or data, and the processing circuit may complete the generation and processing of signaling or data information.

[0071] The embodiments of the present application also provide a chip system, including a processor, for supporting a computing device to implement the functions involved in any of the above embodiments. In one possible design, the chip system may also include a memory for storing necessary program instructions and data, and when the processor runs the program instructions, the device on which the chip system is installed implements the method involved in any of the above embodiments. Exemplarily, the chip system may be composed of one or more chips, and may also include chips and other discrete devices.

[0072] An embodiment of the present application further provides a processor for coupling with a memory, wherein the memory stores instructions. When the processor executes the instructions, the processor executes the methods and functions involved in any of the above embodiments.

[0073] The embodiments of the present application also provide a computer-readable storage medium on which computer instructions or program codes are stored, and when the processor runs the instructions or program codes, the processor executes the methods and functions involved in any of the above embodiments. Computer-readable media can be any tangible medium containing or storing programs for or related to instruction execution systems, devices or equipment. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or devices, or any suitable combination thereof. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrations. More detailed examples of computer-readable storage media include electrical connections with one or more wires, magnetic media (e.g., disks, floppy disks, hard disks, tapes, magnetic storage devices), optical media (e.g., optical storage devices, DVDs), semiconductor media (e.g., solid-state hard drives), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), or any suitable combination thereof, etc.

[0074] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The embodiment of the present application also provides at least one computer program product tangibly stored on a non-temporary computer-readable storage medium. The computer program product includes one or more computer executable instructions, such as instructions included in a program module, which are executed in a device on a real or virtual processor of the target to perform the process, method and function involved in any of the above embodiments. When the computer program instruction is loaded and executed on a computer, a process or function according to an embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0075] According to the method provided in the embodiment of the present application, the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer performs the process, method and function in the above-mentioned embodiment. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of program modules can be combined or divided between program modules as needed. Machine executable instructions for program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in local and remote storage media.

[0076] The computer program code for realizing the method of the present disclosure can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by a computer or other programmable data processing device, causes the function / operation specified in the flow chart and / or block diagram to be implemented. The program code can be executed completely on a computer, partly on a computer, as an independent software package, partly on a computer and partly on a remote computer or completely on a remote computer or server. In the context of the present disclosure, the computer program code or related data can be carried by any appropriate carrier so that equipment, devices or processors can perform various processing and operations described above. The example of carrier includes signal, computer readable medium, etc. The example of signal can include electric, optical, radio, sound or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0077] In general, various embodiments of the present application may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be performed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that the boxes, devices, systems, techniques, or methods described herein may be implemented as, for example, non-limiting examples, hardware, software, firmware, dedicated circuits or logic, general hardware or controllers or other computing devices, or some combination thereof.

[0078] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

[0079] The above specific implementation methods further explain in detail the purpose, technical solutions and beneficial effects of the embodiments of the present application. It should be understood that the above are only specific implementation methods of the embodiments of the present application and are not used to limit the protection scope of the embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of the present application should be included in the protection scope of the embodiments of the present application.

[0080] It should be noted that although the embodiments of the present application are described above in conjunction with the accompanying drawings, the above embodiments are not independent of each other, and they can also be combined to obtain other embodiments. The division of the modes, situations, categories and embodiments in the embodiments of the present application is only for the convenience of description and should not constitute a special limitation. The features in the various modes, categories, situations and embodiments can be combined with each other in a logical manner. The various implementation methods of the present application can be combined arbitrarily to achieve different technical effects. The embodiments of the present application no longer list various combinations.

[0081] In addition, although the operation of the method of the present disclosure is described in a particular order in the accompanying drawings, this does not require or imply that these operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flow chart can change the order of execution. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution. It should also be noted that the features and functions of two or more devices according to the present disclosure can be embodied in one device. Conversely, the features and functions of a device described above can be further divided into being embodied by multiple devices.

[0082] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

Claims

1. A communication method, comprising: Receiving port resource configuration information from a network controller in a software-defined wide area network (SD-WAN), the port resource configuration information being used to establish a secure management tunnel between an edge node in the SD-WAN and an associated route reflector (RR) in the SD-WAN; Sending a security management tunnel establishment request to the RR, wherein the security management tunnel establishment request includes the port number in the port resource configuration information; as well as The security management tunnel with the RR is established based on the port number.

2. The method according to claim 1, wherein the port number is a first port number, the method further comprising: In response to not receiving a response from the RR within a predetermined period, determining a second port number in the port resource configuration information by a preconfigured step size in the port resource configuration information; as well as The security management tunnel with the RR is established based on the second port number.

3. The method according to claim 2, further comprising: In response to failure to successfully establish the security management tunnel after reaching a predetermined number of attempts in the port resource configuration information, sending feedback information to the network controller; as well as Additional port resource configuration information is received from the network controller to retry establishing the secure management tunnel.

4. The method according to claim 2 or 3, wherein determining the second port number by the preconfigured step size comprises: The second port number is determined by increasing or decreasing the port resource configuration information by the preconfigured step size.

5. The method according to any one of claims 1 to 4, wherein the port number is a first port number, the security management tunnel is a first security management tunnel, and the method further comprises: Sending a port change request to the controller, the port change request including the second port number in the port resource configuration information and an identifier of the first security management tunnel; as well as A second security management tunnel with the RR is established based on the second port number.

6. The method according to claim 5, further comprising: After the second security management tunnel is established, the first security management tunnel is closed.

7. The method according to any one of claims 1 to 6, further comprising: The port number and the identifier of the edge node are sent to the network controller.

8. The method according to claim 7, further comprising: In response to not receiving a response from the RR within a predetermined period, sending a negotiation request to the network controller, the negotiation request including an identifier of the edge node and a negotiation port number range; receiving updated port resource configuration information from the controller; as well as The first security management tunnel with the RR is established based on the updated port resource configuration information.

9. A communication system comprising: A network controller in a software defined wide area network (SD-WAN), configured to determine port resource configuration information, the port resource configuration information comprising a port number for establishing a secure management tunnel between an edge node in the SD-WAN and a route reflector (RR) in the SD-WAN; The edge node is configured to receive the port resource configuration information from the network controller and establish the security management tunnel with the RR; as well as The RR is configured to receive the port resource configuration information from the network controller and establish the security management tunnel with the edge node.

10. The system according to claim 9, wherein the port number is a first port number, and the edge node is further configured to: In response to not receiving a response from the RR within a predetermined period, determining a second port number in the port resource configuration information by a preconfigured step size in the port resource configuration information; and The security management tunnel with the RR is established based on the second port number.

11. The system according to claim 10, wherein the edge node is further configured to: In response to failure to successfully establish the security management tunnel after reaching a predetermined number of attempts in the port resource configuration information, sending feedback information to the network controller; and Additional port resource configuration information is received from the network controller to retry establishing the secure management tunnel.

12. The system according to claim 10 or 11, wherein the edge node is further configured to: The second port is determined by increasing or decreasing the port resource configuration information by the preconfigured step size.

13. The system according to any one of claims 9 to 12, wherein the port number is a first port number, the security management tunnel is a first security management tunnel, and the edge node is further configured to: Sending a port change request to the controller, the port change request including the second port number in the port resource configuration information and an identifier of the first security management tunnel; and A second security management tunnel with the RR is established based on the second port number.

14. The system of claim 13, wherein the edge node is further configured to: After the second security management tunnel is established, the first security management tunnel is closed.

15. The system according to any one of claims 9 to 14, wherein the edge node is further configured to: The port number and the identifier of the edge node are sent to the network controller.

16. The method according to claim 15, wherein the edge node is further configured to: In response to not receiving a response from the RR within a predetermined period, sending a negotiation request to the network controller, the negotiation request including an identifier of the edge node and a negotiation port number range; receiving updated port resource configuration information from the controller; as well as The first security management tunnel with the RR is established based on the updated port resource configuration information.

17. An electronic device, characterized in that: include: at least one computing unit; At least one memory, the at least one memory being coupled to the at least one computing unit and storing instructions for execution by the at least one computing unit, the instructions, when executed by the at least one computing unit, causing the device to perform the method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

19. A computer program product, characterized in that The computer program product comprises computer executable instructions which, when executed by a processor, cause an apparatus to perform a method according to any one of claims 1 to 8.

Images