Service transmission methods, devices, network equipment and storage media

Abstract

The present application provides a service transmission method, apparatus, device and storage medium, including: after detecting a current link failure, adjusting the current network configuration and modifying the current security rules; determining a temporary interface based on the adjusted network configuration; opening the temporary interface to an external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device; and using the modified security rules on the temporary link to perform service transmission.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a service transmission method, device, network equipment and storage medium. Background Art

[0002] The implementation principle of network security protocol is to negotiate keys through protocol, set security rules, encrypt user data messages that match the rules, and add integrity checks, etc. For some centralized access points, additional message headers are added to encapsulate user messages in tunnels, such as the tunnel mode of IPsec's Encapsulating Security Payload (ESP) protocol. The MACsec protocol can also encrypt and encapsulate the user's virtual local area network (VLAN) tag and internal Ethernet message, so that external devices are completely unaware of the communication messages, protecting the security of the communication link.

[0003] The security policies of traditional network security protocols, whether IPsec or MACsec, are all statically configured. After the user configuration takes effect, the rules will not change. This approach has good security and can fully implement security requirements according to user rules.

[0004] However, once a network failure occurs, whether it is a security device failure or a corresponding software or function failure, the link between the two communicating parties will be interrupted and business transmission will be impossible. Summary of the invention

[0005] The service transmission method, apparatus, network device and storage medium provided in the present application are used to implement service transmission after a link failure.

[0006] In a first aspect, an embodiment of the present application provides a service transmission method, including:

[0007] After detecting the current link failure, adjust the current network configuration and modify the current security rules;

[0008] determining a temporary interface based on the adjusted network configuration;

[0009] Opening the temporary interface to an external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device;

[0010] The modified security rule is used to transmit traffic on the temporary link.

[0011] In a second aspect, an embodiment of the present application provides a service transmission device, including:

[0012] The detection module is configured to adjust the current network configuration and modify the current security rules after detecting the current link failure;

[0013] a determination module configured to determine a temporary interface based on the adjusted network configuration;

[0014] An interface module, configured to open the temporary interface to an external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device;

[0015] The transmission module is configured to use the modified security rules to perform service transmission on the temporary link.

[0016] In a third aspect, an embodiment of the present application provides a network device, including:

[0017] one or more processors;

[0018] A memory for storing one or more programs;

[0019] When the one or more programs are executed by the one or more processors, the one or more processors implement any method provided in the embodiments of the present application.

[0020] In a fourth aspect, an embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of the embodiments of the present application is implemented.

[0021] The service transmission method, apparatus, device and storage medium provided in the embodiments of the present application adjust the current network configuration and modify the current security rules of the current device service after detecting the current link failure, and open a temporary interface to the external device so that the external device can re-access the current device. The service re-access capability can be provided through the temporary interface, thereby avoiding the interruption of the link between the two communicating parties caused by network failure and the inability to perform service transmission, thereby effectively improving the availability of the system.

[0022] With regard to the above embodiments and other aspects of the present application and their implementation, further description is provided in the accompanying drawings, detailed description and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a diagram of security protocol application scenarios;

[0024] Figure 2 It is a flow chart of a service transmission method provided by an embodiment of the present application;

[0025] Figure 3 This is a business data flow diagram for enabling a temporary link provided by an embodiment of the present application;

[0026] Figure 4 is a flow chart of the service transmission solution provided in an embodiment of the present application;

[0027] Figure 5 It is a structural diagram of a service transmission device provided in an embodiment of the present application;

[0028] Figure 6 It is a structural diagram of a network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present application more clear, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other arbitrarily without conflict.

[0030] The steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions. Also, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described can be performed in a sequence different from that shown here.

[0031] Network security has developed to a relatively mature framework and theory, and involves many scenarios and methods, such as cryptography, access control, authentication management, transmission security, and sensitive data protection. Among them, transmission security is the main technology to solve the confidentiality and integrity of data transmission in an untrusted network environment. Transmission security technologies mainly include Media Access Control Security (MACsec), Internet Protocol Security (IPsec), Secure Socket Layer (SSL), and Transport Layer Security (TLS). Among them, the IPsec protocol is the most widely used, which can solve network layer security problems and is used as a secure transmission protocol between base stations and core networks.

[0032] The implementation principle of network security protocol is to negotiate keys through the protocol, set security rules, encrypt user data messages that hit the rules, and add integrity checks, etc. For some centralized access points, additional message headers are added to encapsulate user messages in tunnels, such as the tunnel mode of the ESP protocol of IPsec. The MACsec protocol can also encrypt and encapsulate user VLAN tags and internal Ethernet messages, so that external devices are completely unaware of the communication messages, protecting the security of the communication link.

[0033] The security policies of traditional network security protocols, whether IPsec or MACsec, are all statically configured. The rules will not change after the user configuration takes effect. Although this is a better way to handle security, and security requirements can be fully implemented according to user rules, once a network failure occurs, whether it is a security device failure or a corresponding software or function failure, it will cause the communication link to be interrupted. Due to the characteristics of the security protocol, such as mandatory encryption of data according to security rules, the sender's encrypted message cannot be decrypted by other devices except the failed peer device, or the received data cannot be correctly decrypted and is discarded.

[0034] For example, if both parties in IPsec communication configure security policies and encrypt and encapsulate the management plane messages of the data through the ESP tunnel mode, if the responder's security gateway (Security Gateway, SeGW) fails, the IPsec initiator will continue to process and send the management plane messages in an encrypted manner, and the other end cannot parse it, or because the link detection key update renegotiation fails, the management plane message is discarded, resulting in the receiving party's network management or management tools being unable to access the device normally. For some distributed equipment, such as base stations, maintenance personnel are required to go to the site to find out the cause and solve it on site, which is extremely costly.

[0035] Figure 1 It is a diagram of security protocol application scenarios, such as Figure 1 As shown in the figure, the typical networking of the wireless access network is composed of an operation and maintenance center (OMC), tools, an evolved package core (EPC) or a 5G core (5G Core), a secure gateway (SeGW), a base station, a router or a switch. Among them, the OMC includes an element management system (EMS). The tools include remote access tools Secure Shell (SSH) and Hyper Text Transfer Protocol over Secure Socket Layer (HTTPs).

[0036] The links between the base station and OMC, Tools and EPC / 5G Core are application links. The links between the base station and the security gateway are security links.

[0037] In one embodiment, a service transmission method is provided. Figure 2 1 is a flow chart of a service transmission method provided by an embodiment of the present application. Figure 2As shown, the service transmission method provided in the embodiment of the present application mainly includes steps S11, S12, S13 and S14.

[0038] S11. After detecting the current link failure, adjust the current network configuration and modify the current security rules.

[0039] S12. Determine a temporary interface based on the adjusted network configuration.

[0040] S13. Open the temporary interface to the external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device.

[0041] S14. Use the modified security rules to perform service transmission on the temporary link.

[0042] In this embodiment, the service transmission method is executed by the current device. The current device includes a network device that supports the network security tunnel protocol, for example, the current device is a base station or a set-top box.

[0043] The current link refers to the link or channel through which the current device transmits data with external devices after encryption and decryption through the security gateway. The current network configuration refers to the configuration status of the network when the current link is normal. The current security rules refer to the security rules or security protocols used when the current link is normal.

[0044] It should be noted that different detection methods may be used based on the different current link security protocols. This embodiment does not limit the link detection method.

[0045] In this embodiment, the external device refers to a remote management device or a remote control device, such as Figure 1 OMC, EMS, SSH, etc. shown.

[0046] In an exemplary embodiment, adjusting the current network configuration includes one or more of the following:

[0047] Switch the loopback Internet Protocol IP address corresponding to the preset protocol to the physical network port interface IP address;

[0048] Adjust the virtual local area network VLAN configuration,

[0049] Adjust the address translation policy of centralized access devices.

[0050] The address conversion strategy of the centralized access device includes one or more of the following:

[0051] For centralized access devices, add the conversion relationship between internal and external addresses, the routing table of temporary links, and the access control list configuration.

[0052] In an exemplary embodiment, when the loopback Internet Protocol IP address corresponding to the preset protocol is switched to the physical network port interface IP address, determining the temporary interface based on the adjusted network configuration includes: determining the corresponding temporary interface based on the physical network port interface IP address.

[0053] In an exemplary embodiment, the modification of the current security rules includes one or more of the following: setting the security rules of important services to non-encrypted pass; removing the current interface from the encryption group; not encrypting the current message; and restoring the normal VLAN configuration when the current message is configured with a VLAN tag.

[0054] In an exemplary implementation, the important services include one or more of the following: management plane services, control plane services, and user-defined services.

[0055] In this embodiment, the service of the current device may be all services of the current device. In this embodiment, the service of the current device is an important service of the current device. The important service refers to a management plane service and / or a control plane service, and may also be a user-defined service.

[0056] For the device, not all data needs to be restored. The cost of full recovery is very high. Bypassing the security protocol will also reduce the security of the service. This embodiment mainly focuses on important management messages or control plane messages, and provides a new temporary access channel when the security protocol fails.

[0057] In an exemplary implementation, the current link failure includes a security link failure and an application link failure.

[0058] A security link failure refers to a failure between security protocol layers, and an application link failure refers to a link failure between application layers. For example, in a 7-layer network architecture, the application layer is above the security layer (which may be deployed on the transport layer, network layer, or link layer).

[0059] After detecting the current link failure, including detecting the application link disconnection, a security link detection is initiated, and after detecting the security link disconnection, it is determined that the current link fails.

[0060] In an exemplary embodiment, the temporary link includes: an address conversion protocol of an intermediate forwarding device or a centralized access device, and a detour temporary channel.

[0061] In an exemplary embodiment, the using the modified security rule to perform service transmission on the temporary link includes:

[0062] If the external device accesses the current device through the internal network, the service transmission is performed through the address conversion protocol of the intermediate forwarding device or the centralized access device.

[0063] In this embodiment, the intermediate forwarding device may be Figure 1 The centralized access device can be a switch or router as shown in Figure 1 The security gateway in.

[0064] In this embodiment, if the intermediate forwarding device or the centralized access device is in normal use and has no faults after the current link fails, the service message can be transmitted through the address translation protocol of the intermediate forwarding device or the centralized access device.

[0065] Transmission through the address translation protocol can be understood as the intermediate forwarding device or the centralized access device only converts the service message according to the address translation protocol and then transmits it without performing decryption or encryption.

[0066] In an exemplary embodiment, the using the modified security rule to transmit the service on the temporary link includes: if the external device accesses the current device through the bypassed temporary channel, then transmitting the service through the bypassed temporary channel.

[0067] In this embodiment, if the intermediate forwarding device or the centralized access device cannot be used normally after the current link fails, the external device directly accesses the current device using a bypassed temporary channel and transmits services through the bypassed temporary channel. The bypassed temporary channel means that the external device bypasses the intermediate forwarding device and the centralized access device and directly accesses the current device using a transmission reachable link, without the need for the intermediate forwarding device or the centralized access device to perform an address conversion protocol.

[0068] In an exemplary embodiment, after opening the temporary interface to the external device, it also includes: saving the adjusted network configuration, modified security rules and service list; when the next link failure occurs, calling and saving the saved modified network configuration, the modified security rules and the service list.

[0069] In this embodiment, after the temporary link is established, this part of the temporarily generated network configuration and security rules, as well as the service-related list are saved to disk so that this configuration can be read first at the next failure, avoiding the need to modify the network configuration and security rules every time a failure occurs.

[0070] In an exemplary embodiment, after opening the temporary interface to the external device, the method further includes: switching to the current network configuration according to a set period; and performing a reset operation when the number of switching failures exceeds a set number.

[0071] If the important services that need to be protected cannot be restored after switching to a temporary link, the system will switch to the original configuration at a scheduled time. If the services continue to be unable to be restored and the number of switching exceeds a certain threshold, the system will try to save itself through other methods such as resetting.

[0072] In an exemplary embodiment, after opening a temporary interface to an external device, the method further includes: after detecting that the current link has been restored, switching to the current network configuration and the current security rules; and providing services to the external device using the current network configuration and the current security rules.

[0073] After the network enables the above service transmission method, when the security protocol fails, it can provide important services with the ability to access them again to the greatest extent possible, effectively improving the availability of the system.

[0074] In one embodiment, in the case of a network security protocol failure, the current device needs to do its best to ensure access to important services, such as management plane services or control plane services. After detecting a failure, it is necessary to switch the corresponding IP and other network transmissions according to the networking situation, and automatically switch the transmission configuration and security policy, modify the previously encrypted message to a non-encrypted or tunnel encapsulated state, and configure the corresponding address translation and routing forwarding rules on the intermediate forwarding device or centralized access device in advance to ensure access to important services as much as possible.

[0075] The communicating parties need to periodically or actively detect the current link.

[0076] Among them, detection is divided into different levels, mainly including security protocol link detection between security devices and application link detection between application devices.

[0077] Further, after detecting that the application link is broken, a security link detection is further initiated, and after detecting that the security link is broken, it is determined that the current link is faulty. Further, if the security device and the application device are the same device, the detection method is unified.

[0078] Users can plan their network in advance based on the current network configuration.

[0079] If the current device security protocol fails and a new transmission IP address is switched, a new address translation policy needs to be configured on the intermediate forwarding device or centralized access device (such as a firewall or SeGW). The above address translation policy includes NAT or the routing table of the new transmission link, access control list (ACL) configuration, etc.

[0080] After detecting a link failure, the current device automatically adjusts the corresponding network configuration, revises the current security rules for important services, and opens a new temporary interface to the outside world, so that external devices can be temporarily managed by the current device to provide temporary services. The temporary interface is a control interface or a management interface.

[0081] like Figure 3 As shown, after the security protocol link fails, a new temporary link is established, and the current device directly transmits data with the current device by using NAT or bypassing the centralized access device.

[0082] Among them, the important business can be a management plane business, a control plane business, or user-defined business data.

[0083] The network configuration mainly includes the IP addresses associated with important services, as well as the corresponding network ports, VLAN and other configurations. It also includes the address translation strategy (such as NAT) of the intermediate network equipment, access control list (ACL) configuration, etc. For example, the loopback IP address previously associated with the service in the security tunnel is temporarily reassigned to the interface IP address of the specified physical network port. And for the network centralized access equipment (such as SeGW or firewall), add the conversion relationship from internal address to external address, as well as the corresponding routing forwarding table, and place the public network IP mapped to the internal network in the ACL allowed list.

[0084] Security rules can be messages that meet current characteristics (typically a five-tuple, source IP, destination IP, protocol, source port, destination port), and perform actions such as encryption, rejection, and direct passage. They can also be user-specific processing rules for certain types of messages.

[0085] Opening a new temporary interface to the outside world can be a newly enabled service, or it can be a service that encrypts the previous security protocol or encapsulates it in a tunnel and cannot be directly accessed, to facilitate the hosting of new services.

[0086] The external device reconnects to the current device and sends the message to the current device through the network address translation of the intermediate forwarding device or the centralized access device. The message replied by the current device no longer passes through the previous security protocol or security tunnel encapsulation, but directly uses the new access protocol.

[0087] If a temporary link is established, save the temporarily generated network configuration and security rules, as well as the service-related list, and read this configuration first when a failure occurs next time.

[0088] If the current device detects that the security link or application link is restored, a switching rule is set to delete the temporarily generated configuration and rules, and then switch to the original configuration, and re-encapsulate the service in the original security protocol or security tunnel.

[0089] If the important services that need to be protected cannot be restored after switching to a temporary link, the system will switch to the original configuration at a scheduled time. If the services continue to be unable to be restored and the number of switching exceeds a certain threshold, the system will try to save itself through other methods such as resetting.

[0090] Important business data flows are generally management data or signaling data.

[0091] After the system enables this function, when the security protocol fails, it can provide important business re-access capabilities to the greatest extent possible, effectively improving the availability of the system.

[0092] In one embodiment, the IPsec protocol is used as an example for description.

[0093] The security protocol currently used by the device is IPsec (ESP tunnel encapsulation). The important application protocol is the management plane protocol, which uses the netconf protocol. The security protocol uses BFD (Bidirectional Forwarding Detection) or DPD (Dead Peer Detection) as link detection, and the netconf protocol uses a timed handshake method for link detection. If the netconf link is broken, further check whether it is caused by an IPsec link failure.

[0094] Based on the current network configuration and network planning in advance, if the device security protocol fails, the user can switch to a new transmission IP address, etc., and configure a new transmission strategy on the intermediate routing forwarding device or centralized access device (such as a firewall or SeGW), such as NAT (conversion of the intranet address of the network management or tool to the external network address) or the routing table of the new transmission link (to the external network route of the network management or tool).

[0095] If an IPsec link interruption is detected, the current device switches the loopback IP address corresponding to the netconf to the physical network port interface IP address, and then sets the security rule of the netconf protocol to non-encryption.

[0096] If there are other management services, such as SSH / HTTPs operation and maintenance interfaces, similar to the above netconf protocol, switch the previously associated loopback IP to the physical network interface IP, and set the corresponding security rules to non-encrypted.

[0097] The network management or tool can bypass SeGW and directly use the public IP to access the current netconf management interface of the device, or SSH / HTTPs service. It can also use SeGW (normal operation). SeGW or the front firewall can translate the intranet address of the network management or tool into a public IP and put this public IP in the ACL allowed list. In addition to the security protection of the new protocol netconf / SSH / HTTPs itself, the device and SeGW no longer perform IPsec encryption and encapsulation tunnel processing on such messages.

[0098] If a temporary link is established, save the temporarily generated configuration and rules, as well as the service-related list, to disk, and read this configuration first when a failure occurs next time.

[0099] If the current device detects that the IPsec link is restored, it sets the switching rules, deletes the temporarily generated configuration and rules, switches to the original configuration, and re-encapsulates the service (netconf / SSH / HTTPs) in the original IPsec tunnel.

[0100] If the NETCONF service cannot be restored after switching to the temporary channel, the system will periodically switch to the original configuration. If the service continues to be unable to be restored and the number of switches exceeds a certain threshold, the system will try to save itself through other methods such as resetting.

[0101] The device may be a base station, a set-top box or other network devices supporting a network security tunneling protocol.

[0102] After the system enables this function, when the security protocol fails, it can provide important business re-access capabilities to the greatest extent possible, effectively improving the availability of the system.

[0103] In one embodiment, Figure 4 As shown in the figure, the link detection module is used to detect the current link. The configuration module is used to modify the network configuration, security rules and open interface configuration. In order to achieve the ability to provide important business access again to the greatest extent possible when the security protocol fails,

[0104] In one embodiment, the security protocol is taken as an example to illustrate.

[0105] The security protocol currently used by the device is MACsec (VLAN tag encryption mode). The important application protocol is the management plane protocol, which uses the netconf protocol. The netconf protocol uses a timed handshake method to perform link detection. If the netconf link is broken, further check whether it is caused by the MACsec link.

[0106] Users plan the network in advance based on the current network configuration. If the device security protocol fails, the connected switching device can remove the current device from the MACsec group, that is, the messages of the current device will no longer be encrypted by MACsec.

[0107] If a NETCONF disconnection is detected, the current device sets the security rule of the NETCONF protocol to non-encrypted transmission, or removes the current port from the MACsec encryption group, or does not perform MACsec encryption on the current message. If the current NETCONF message is configured with a VLAN tag (encrypted in the MACsec protocol), the previous VLAN configuration is restored.

[0108] If there are other management services, such as SSH / HTTPs operation and maintenance interfaces, similar to the above netconf protocol, modify the previously associated security rules, remove the current port from the MACsec encryption group, or do not perform MACsec encryption on the current message.

[0109] Network management or tools directly access the current device through an intermediate forwarding device or centralized access device. In addition to the security protection of the new protocol netconf / SSH / HTTPs itself, centralized access devices and switches no longer perform MACsec encryption and VLAN tag encryption and encapsulation on such messages.

[0110] If a temporary link is established, save the temporarily generated configuration and rules, as well as the service-related list, to disk, and read this configuration first when a failure occurs next time.

[0111] If the current device detects that the MACsec link is restored, it sets a switching rule, deletes the temporarily generated configuration and rules, switches to the original configuration, and re-encapsulates the service (netconf / SSH / HTTPs) in the original MACsec encryption channel.

[0112] If the NETCONF service cannot be restored after switching to a temporary link, the system will periodically switch to the original configuration. If the service continues to be unable to be restored and the number of switching exceeds a certain threshold, the system will try to save itself through other methods such as resetting.

[0113] The current device may be a network device that supports a network security tunnel protocol, such as a base station, a set-top box, etc.

[0114] After the system enables this function, when the security protocol fails, it can provide important business re-access capabilities to the greatest extent possible, effectively improving the availability of the system.

[0115] In one embodiment, a service transmission device is provided. Figure 5Schematic diagram of a service transmission device provided in an embodiment of the present application. Figure 5 As shown, the service transmission device provided in the embodiment of the present application mainly includes a detection module 51, a determination module 52, an interface module 53 and a transmission module 54.

[0116] The detection module 51 is configured to adjust the current network configuration and modify the current security rules after detecting the current link failure;

[0117] A determination module 52, configured to determine a temporary interface based on the adjusted network configuration;

[0118] The interface module 53 is configured to open the temporary interface to the external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device;

[0119] The transmission module 54 is configured to use the modified security rule to perform service transmission on the temporary link.

[0120] In an exemplary embodiment, the adjustment of the current network configuration includes one or more of the following: switching the loopback Internet Protocol IP address corresponding to the preset protocol to the physical network port interface IP address; adjusting the virtual local area network VLAN configuration, and adjusting the address translation strategy of the centralized access device.

[0121] In an exemplary embodiment, the address conversion strategy of the centralized access device includes one or more of the following: adding a conversion relationship between an internal address and an external address for the centralized access device, a routing table of a temporary link, and an access control list configuration.

[0122] In an exemplary embodiment, when the loopback Internet Protocol IP address corresponding to the preset protocol is switched to the physical network port interface IP address, determining the temporary interface based on the adjusted network configuration includes: determining the corresponding temporary interface based on the physical network port interface IP address.

[0123] In an exemplary embodiment, the modification of the current security rules includes one or more of the following: setting the security rules of important services to non-encrypted pass; removing the current interface from the encryption group; not encrypting the current message; and restoring the normal VLAN configuration when the current message is configured with a VLAN tag.

[0124] In an exemplary implementation, the important services include one or more of the following: management plane services, control plane services, and user-defined services.

[0125] In an exemplary implementation, the current link failure includes a security link failure and an application link failure.

[0126] In an exemplary embodiment, the temporary link includes: an address translation protocol of an intermediate forwarding device or a centralized access device, a detour temporary channel, and using the modified security rules on the temporary link to transmit services includes:

[0127] If the external device accesses the current device through the internal network, the service transmission is performed through the address conversion protocol of the intermediate forwarding device or the centralized access device;

[0128] If the external device is connected to the current device through the detour temporary channel, service transmission is performed through the detour temporary channel.

[0129] In an exemplary embodiment, after opening the temporary interface to the external device, it also includes: saving the adjusted network configuration, modified security rules and service list; when the next link failure occurs, calling and saving the saved modified network configuration, the modified security rules and the service list.

[0130] In an exemplary embodiment, after opening the temporary interface to the external device, the method further includes: switching to the current network configuration according to a set period; and performing a reset operation when the number of switching failures exceeds a set number.

[0131] In an exemplary embodiment, after opening a temporary interface to an external device, the method further includes: after detecting that the current link has been restored, switching to the current network configuration and the current security rules; and providing services to the external device using the current network configuration and the current security rules.

[0132] In an exemplary implementation, the current device includes: a network device supporting a network security tunneling protocol.

[0133] The controller provided in this embodiment can execute the service transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method. For technical details not described in detail in this embodiment, please refer to the service transmission method provided in any embodiment of the present invention.

[0134] It is worth noting that in the embodiment of the above-mentioned business transmission device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.

[0135] The embodiment of the present application also provides a network device, Figure 6 is a schematic diagram of the structure of a network device provided in an embodiment of the present application, such as Figure 6 As shown, the network device includes a processor 61, a memory 62, an input device 63, an output device 64 and a communication device 65; the number of processors 61 in the network device can be one or more. Figure 6 A processor 61 is taken as an example; the processor 61, the memory 62, the input device 63 and the output device 64 in the network device can be connected by a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0136] The memory 62, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the service transmission method in the embodiment of the present application (for example, the detection module 51, the determination module 52, the interface module 53 and the transmission module 54 in the service transmission device). The processor 61 executes various functional applications and data processing of the network device by running the software programs, instructions and modules stored in the memory 62, that is, implementing any method provided in the embodiment of the present application.

[0137] The memory 62 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the network device, etc. In addition, the memory 62 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 62 may further include a memory remotely arranged relative to the processor 61, and these remote memories may be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0138] The input device 63 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the network device. The output device 64 may include a display device such as a display screen.

[0139] The communication device 65 may include a receiver and a transmitter. The communication device 65 is configured to perform information transmission and reception communication according to the control of the processor 61.

[0140] In an exemplary embodiment, the present application also provides a storage medium containing computer executable instructions, wherein the computer executable instructions are used to perform a service transmission method when executed by a computer processor, including:

[0141] After detecting the current link failure, adjust the current network configuration and modify the current security rules;

[0142] determining a temporary interface based on the adjusted network configuration;

[0143] Opening the temporary interface to an external device; wherein the temporary interface is used for the external device to establish a temporary link with the current device;

[0144] The modified security rule is used to transmit traffic on the temporary link.

[0145] Of course, the storage medium containing computer executable instructions provided in the embodiment of the present application, whose computer executable instructions are not limited to the method operations described above, can also execute related operations in the business transmission method provided in any embodiment of the present application.

[0146] Through the above description of the implementation method, the technicians in the relevant field can clearly understand that the present application can be implemented with the help of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0147] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

[0148] It will be appreciated by those skilled in the art that the term user terminal covers any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a vehicle-mounted mobile station.

[0149] In general, various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software that can be executed by a controller, microprocessor or other computing device, although the present application is not limited thereto.

[0150] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0151] The block diagram of any logic flow in the accompanying drawings of the present application can represent program steps, or can represent interconnected logic circuits, modules and functions, or can represent a combination of program steps and logic circuits, modules and functions. The computer program can be stored on a memory. The memory can have any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical memory device and system (digital versatile disc DVD or CD disc), etc. Computer-readable media may include non-transient storage media. The data processor can be any type suitable for the local technical environment, such as but not limited to a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a programmable logic device (FGPA) and a processor based on a multi-core processor architecture.

[0152] By way of exemplary and non-limiting examples, a detailed description of exemplary embodiments of the present application has been provided above. However, various modifications and adjustments to the above embodiments will be apparent to those skilled in the art when considered in conjunction with the accompanying drawings and claims, but will not depart from the scope of the present invention. Therefore, the proper scope of the present invention will be determined according to the claims.

Claims

1. A method for performing service transmission at a network device supporting a network security protocol, characterized in that: include: After a current link failure is detected at the network device, the current network configuration is adjusted and the current security rules are modified, wherein the current link includes a link or channel for data transmission between the network device and an external device after encryption and decryption by a security gateway, and the external device includes a remote management device or a remote control device, and wherein adjusting the current network configuration includes one or more of the following: Switch the loopback Internet Protocol IP address corresponding to the preset network security protocol to the interface IP address of the physical network port, or Adjust the virtual local area network VLAN configuration; determining a temporary interface based on the adjusted network configuration; Opening the temporary interface to the external device, wherein the temporary interface is used for the external device to establish a temporary link with the network device; The modified security rule is used to transmit traffic on the temporary link.

2. The method according to claim 1, characterized in that The adjusting the current network configuration further includes: Adjust the address translation policy of centralized access devices.

3. The method according to claim 2, characterized in that The address conversion strategy of the centralized access device includes one or more of the following: For centralized access devices, add the conversion relationship between internal and external addresses, the routing table of temporary links, and the access control list configuration.

4. The method according to claim 1, characterized in that: In the case where the loopback Internet Protocol IP address corresponding to the preset network security protocol is switched to the interface IP address of the physical network port, the determining of the temporary interface based on the adjusted network configuration includes: Determine a corresponding temporary interface based on the interface IP address of the physical network port.

5. The method according to claim 1, characterized in that The modification of the current security rules includes one or more of the following: Set the security rules for important services to pass without encryption; Remove the current interface from the encryption group; Do not encrypt the current message; When the current message is configured with a VLAN tag, restore the normal VLAN configuration.

6. The method according to claim 5, characterized in that The important business includes one or more of the following: Management plane services, control plane services, and user-defined services.

7. The method according to claim 1, characterized in that The temporary link includes: an address conversion protocol of an intermediate forwarding device or a centralized access device, a detour temporary channel, and using the modified security rules on the temporary link to transmit services includes: If the external device accesses the network device through the internal network, the service transmission is performed through the address conversion protocol of the intermediate forwarding device or the centralized access device; If the external device accesses the network device through the detour temporary channel, the service transmission is performed through the detour temporary channel.

8. The method according to claim 1, characterized in that After the temporary interface is opened to the external device, the method further includes: Save the adjusted network configuration, modified security rules and service list; When the link fails next time, the saved modified network configuration, the modified security rules and the service list are called and saved.

9. The method according to claim 1, characterized in that: After the temporary interface is opened to the external device, the method further includes: Switching to the current network configuration according to a set period; If the number of switching failures exceeds the set number, a reset operation is performed.

10. The method according to claim 1, characterized in that After the temporary interface is opened to the external device, the method further includes: After detecting that the current link is restored, switching to the current network configuration and the current security rules; The external device is provided with services using the current network configuration and the current security rules.

11. An apparatus for performing service transmission at a network device supporting a network security protocol, characterized in that: include: The detection module is configured to adjust the current network configuration and modify the current security rules after detecting a current link failure, wherein the current link includes a link or channel for the network device to transmit data with an external device after encryption and decryption through a security gateway, and the external device includes a remote management device or a remote control device, and wherein adjusting the current network configuration includes one or more of the following: Switch the loopback Internet Protocol IP address corresponding to the preset network security protocol to the interface IP address of the physical network port, or Adjust the virtual local area network VLAN configuration; a determination module configured to determine a temporary interface based on the adjusted network configuration; an interface module, configured to open the temporary interface to the external device, wherein the temporary interface is used for the external device to establish a temporary link with the network device; The transmission module is configured to use the modified security rules to perform service transmission on the temporary link.

12. A network device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 10.

13. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images