A virtual switching instance association method and device

Abstract

The present specification provides a method and device for associating a virtual switching instance, and relates to the field of communication technology. A method for associating a virtual switching instance, comprising: receiving an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated; searching for stored user information according to the authentication request, wherein the user information includes a user name and a password, and the password includes a first password and a second password, the first password corresponds to an isolated slave VSI, and the second password corresponds to an intercommunication slave VSI; if the authentication is passed, an authentication response carrying an authorized VSI corresponding to the password to be authenticated is sent to the VTEP, so that the VTEP associates the authorized VSI with the created AC. Through the above method, the flexibility of switching between isolation and intercommunication can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for associating a virtual switching instance. Background Art

[0002] The rapid development of Ethernet has put forward higher requirements for traditional VLAN (Virtual Local Access Network) networks. In order to reduce the complexity of VLAN configuration and IP (Internet Protocol) addresses, PVLAN (Private Virtual LAN, Private VLAN) technology has been applied.

[0003] In VXLAN (Virtual eXtensible LAN) networking, PVLAN over VXLAN is used for further isolation within and between VXLANs. In the current implementation, VSI (Virtual Switching Instance) corresponds to VXLAN one by one, and VSI is divided into master VSI and slave VSI. Slave VSI includes two types, namely interoperable slave VSI and isolated slave VSI. If a terminal is assigned to a certain type of slave VSI, its type is fixed. If the type of the slave VSI is changed, the VLAN to which the terminal belongs needs to be modified again to assign the terminal to another type of slave VSI, and the configuration flexibility is low. Summary of the invention

[0004] To overcome the problems existing in the related art, this specification provides a VSI association method and device.

[0005] In conjunction with the first aspect of the implementation manner of this specification, the present application provides a VSI association method, which is applied to an authentication server, including:

[0006] Receive an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated;

[0007] Searching for stored user information according to the authentication request, wherein the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave VSI, and the second password corresponds to an interoperable slave VSI;

[0008] If the authentication is successful, an authentication response carrying the authorized VSI corresponding to the password to be authenticated is sent to the VTEP, so that the VTEP associates the authorized VSI with the created AC.

[0009] Further, after searching the stored user information according to the authentication request, the method further includes:

[0010] If the authentication fails, the authentication request is discarded.

[0011] In conjunction with the second aspect of the implementation manner of this specification, the present application provides a VSI association method, which is applied to VTEP, including:

[0012] Forwarding the authentication request to the authentication server, wherein the authentication request carries the input user name and password to be authenticated;

[0013] Receive an authentication response fed back by the authentication server, wherein the authentication server stores user information, the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to the isolated slave VSI, the second password corresponds to the interoperable slave VSI, the authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated;

[0014] Create an AC based on the authentication response and associate the AC with the authorized VSI.

[0015] Further, forwarding the authentication request to the authentication server includes:

[0016] receiving an access request sent by a user device;

[0017] If the MAC address carried in the access request is not found in the media access control MAC address table, an authentication request corresponding to the user equipment is sent to the authentication server.

[0018] Furthermore, after receiving the access request sent by the user equipment, the method further includes:

[0019] If the MAC address carried in the access request is found in the MAC address table, the access request is forwarded according to the MAC address.

[0020] Furthermore, the authentication request also includes: a virtual local area network VLAN tag and a MAC address;

[0021] Create an AC based on the authentication response and associate the AC with the authorized VSI, including:

[0022] If the AC corresponding to the VLAN tag has been created, the association between the AC and the authorized VSI is recorded in the MAC address table stored in the VTEP;

[0023] If the AC corresponding to the VLAN tag is not created, an AC is created according to the access interface, VLAN tag, and MAC address, and the AC is associated with the authorized VSI.

[0024] In conjunction with the third aspect of the implementation manner of this specification, the present application provides a VSI association device, applied to an authentication server, including:

[0025] The transceiver unit is used to receive an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated;

[0026] A search unit, configured to search the stored user information according to the authentication request, wherein the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave virtual switching instance VSI, and the second password corresponds to an interoperable slave VSI;

[0027] The transceiver unit is further configured to send an authentication response carrying an authorized VSI corresponding to the password to be authenticated to the scalable virtual local area network tunnel endpoint VTEP if the authentication is passed, so that the VTEP associates the authorized VSI with the created AC.

[0028] In conjunction with the fourth aspect of the implementation manner of this specification, the present application provides a VSI association device, applied to a VTEP, including:

[0029] The transceiver unit is used to forward the authentication request to the authentication server, wherein the authentication request carries the input user name and password to be authenticated;

[0030] The transceiver unit is used to receive the authentication response fed back by the authentication server, wherein the authentication server stores user information, the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to the isolated slave VSI, the second password corresponds to the intercommunication slave VSI, the authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated;

[0031] The association unit is used to create an AC according to the authentication response and associate the AC with the authorized VSI.

[0032] Furthermore, the sending unit includes:

[0033] A receiving module, used for receiving an access request sent by a user device;

[0034] The sending module is used to send an authentication request corresponding to the user equipment to the authentication server if the MAC address carried in the access request is not found in the media access control MAC address table; if the MAC address carried in the access request is found in the MAC address table, the access request is forwarded according to the MAC address.

[0035] Furthermore, the authentication request also includes: a virtual local area network VLAN tag and a MAC address;

[0036] The association unit is specifically used to record the association relationship between the AC and the authorized VSI in the MAC address table stored in the VTEP if the AC corresponding to the VLAN tag has been created; if the AC corresponding to the VLAN tag has not been created, create the AC according to the access interface, VLAN tag and MAC address, and associate the AC with the authorized VSI.

[0037] In combination with the fifth aspect of the implementation manner of this specification, the present application provides a server, including a transceiver, a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to: implement any method step of the first aspect or any method step of the second aspect.

[0038] In conjunction with the sixth aspect of the implementation manner of this specification, the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to: implement any method step of the first aspect or any method step of the second aspect.

[0039] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0040] In the implementation manner of this specification, an isolated slave VSI and an interoperable slave VSI are configured on the authentication server, and the two slave VSIs are associated with different passwords. During the user authentication process, an AC is created to associate with the two VSIs respectively, so that the user can switch between the isolated slave VSI and the interoperable slave VSI, thereby improving the flexibility of switching between isolation and interoperability.

[0041] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0043] Figure 1 It is a flow chart of a VSI association method involved in an implementation manner of the present application, which is applied to VTEP;

[0044] Figure 2 is a network diagram of a VSI association method involved in an implementation manner of the present application;

[0045] Figure 3 It is a flowchart of a VSI association method involved in an implementation manner of the present application, which is applied to an authentication server;

[0046] Figure 4 is a network diagram of a VSI association method involved in an implementation manner of the present application;

[0047] Figure 5 1 is a network diagram of a VSI association method involved in an embodiment of the present application, wherein user equipment 1 and user equipment 2 are associated with an isolated slave VSI, and user equipment 3 and user equipment 4 are associated with an interoperable slave VSI;

[0048] Figure 6 1 is a network diagram of a VSI association method involved in an embodiment of the present application, wherein user equipment 1 is associated with an isolated slave VSI, and user equipment 2, user equipment 3, and user equipment 4 are associated with an interoperable slave VSI;

[0049] Figure 7 It is a structural diagram of a VSI association device involved in an implementation manner of the present application, which is applied to VTEP;

[0050] Figure 8 It is a flowchart of a VSI association method involved in an implementation manner of the present application, which is applied to an authentication server;

[0051] Fig. 9 It is a structural diagram of a server involved in an implementation manner of the present application. DETAILED DESCRIPTION

[0052] Here, exemplary embodiments are described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification.

[0053] This application provides a VSI association method, which is applied to an authentication server, such as Figure 1 As shown, including:

[0054] S100: Receive an authentication request from a user equipment.

[0055] For example, the above method can be applied to Figure 2 In the networking shown, a VTEP (VXLAN Tunnel End Point) is included in the networking, and an authentication server connected to the VTEP. The downlink port of the VTEP is connected to multiple switching devices, and the uplink port of the switching device is pre-configured with multiple VLANs, and multiple user devices are connected in the downlink direction of the switching device.

[0056] VTEP, switching equipment and user equipment can be physical equipment or virtual equipment formed virtually in the server. The authentication server can be combined with VTEP or can be a physical device connected to VTEP, and there is no restriction on this. In order to achieve isolation or intercommunication, the VTEP is configured as a master VSI, and the user equipment contained therein will be configured according to the type of slave VSI. The slave VSI is divided into an isolated slave VSI and an intercommunication slave VSI. Among them, data cannot be transmitted between user equipment associated with the isolated slave VSI, while output transmission can be performed between user equipment associated with the intercommunication slave VSI and belonging to the same VLAN.

[0057] The authentication request carries the input user name and password to be authenticated. The user name and password to be authenticated can be the user name and password entered by the user on the authentication page after the VTEP redirects the user device to the authentication server when the user device initiates an access request, or it can be the user name and password associated with the MAC (Media Access Control) address.

[0058] It should be noted that the authentication request also includes other information, such as the access interface that receives the authentication request, the VLAN tag, and the MAC address of the user device.

[0059] S101. Search for stored user information according to an authentication request.

[0060] Multiple sets of legal user information are pre-stored on the authentication server, and the user information includes user names and passwords.

[0061] In order to select a slave VSI according to the password entered by the user, one user name is configured with two passwords, namely, a first password and a second password. The first password corresponds to an isolated slave VSI, and the second password corresponds to an interoperable slave VSI.

[0062] After receiving the authentication request, the authentication server parses out the user name and password to be authenticated. Through the user name and password to be authenticated, the authentication server checks whether the corresponding user name and password are stored. After the user name to be authenticated matches the user name, the password to be authenticated needs to be matched. At this time, it is necessary to determine which password under the user name to be authenticated matches the password to be authenticated. For example, the password to be authenticated matches the second password.

[0063] S102: If the authentication is successful, an authentication response carrying the authorized VSI corresponding to the password to be authenticated is sent to the VTEP, so that the VTEP associates the authorized VSI with the created AC.

[0064] The authentication server matches the second password, indicating that the authentication request is authenticated. The authentication server can find out and read the interoperable slave VSI corresponding to the second password according to the second password.

[0065] Thereafter, the authentication server may generate an authentication response for the authentication request, in which the authorized VSI is carried. In this example, the authorized VSI is the interoperable slave VSI.

[0066] After VTEP receives the authorized VSI, it considers that the user device has passed the authentication and can be accessed within the scope allowed by the authorized VSI. Then, VTEP can create AC (Attachment Circuit) based on the access interface, VLAN tag and MAC address obtained during the authentication process, and associate the authorized VSI and AC so that the user device can perform corresponding forwarding through VTEP. Among them, AC can be considered as Ethernet service instance. Ethernet service instance is created on the Layer 2 Ethernet interface of VTEP. It defines a series of matching rules to match the data received from the Layer 2 Ethernet interface. AC is used to represent Ethernet service instance in the future. By associating AC and VSI, the packets that meet the matching rules are forwarded based on VSI, so that user devices can cross VXLAN.

[0067] Further, after searching the stored user information according to the authentication request, the method further includes:

[0068] S103: If the authentication fails, the authentication request is discarded.

[0069] When the authentication fails, that is, the authentication server does not record the username and / or password in the authentication request, the authentication server may discard the authentication request. If the VTEP does not receive an authentication response within a preset time period, the authentication may be considered to have failed.

[0070] Correspondingly, the present application provides a VSI association method, which is applied to VTEP, such as Figure 3 As shown, including:

[0071] S300: Forward the authentication request to the authentication server.

[0072] The authentication request carries the input user name and password to be authenticated.

[0073] Further, step S300, forwarding the authentication request to the authentication server, includes:

[0074] S300A: Receive an access request sent by a user device.

[0075] S300B: If the MAC address carried in the access request is not found in the MAC address table, an authentication request corresponding to the user equipment is sent to the authentication server.

[0076] Further, step S300A, after receiving the access request sent by the user equipment, further includes:

[0077] S300C: If the MAC address carried in the access request is found in the MAC address table, the access request is forwarded according to the MAC address.

[0078] After VTEP receives the access request sent by the user device, it parses the MAC address of the user device carried in the access request (the MAC address is the source MAC address) and the destination MAC address carried in the access request, and searches the MAC address table stored in VTEP through the source MAC address. If the MAC address table has stored the relevant information of the source MAC address, it can be considered that the user device has been authenticated and can be forwarded according to the result of the table lookup (determining the outbound interface according to the destination MAC address). If the MAC address table does not store the relevant information of the source MAC address, it is considered that the user device has not been authenticated and needs to initiate an authentication request to the authentication server.

[0079] At this time, the VTEP can redirect or, based on the correspondence between the recorded source MAC address and the user name and password, enable the unauthenticated user device to initiate an authentication request to the authentication server.

[0080] S301: Receive an authentication response fed back by an authentication server.

[0081] S302: Create an AC according to the authentication response, and associate the AC with the authorized VSI.

[0082] The authentication server stores user information, including a user name and a password. The password includes a first password and a second password. The first password corresponds to an isolated slave VSI, and the second password corresponds to an interoperable slave VSI. The authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated.

[0083] After receiving the authentication response sent by the authentication server, an AC is created based on the recorded access interface, VLAN tag, and MAC address, and the AC is associated with the authorized VSI so that the VTEP can forward the data of the user device. In the VTEP, a VSI will store a corresponding MAC address table. When the VTEP receives an upstream message (such as an access request), it can obtain the source MAC address, access interface, VLAN tag and other information contained in the message and record the corresponding MAC address table entry in the MAC address table. Flooding is performed in the network, and the VTEP at the other end guides the forwarding to the user device based on the MAC address table entry. It should be noted that the AC created here is a dynamic AC, that is, the AC is created through information such as VLAN tags.

[0084] If the AC-associated authorized VSI is an interoperable slave VSI, the data sent by the user device can be forwarded through the VXLAN tunnel corresponding to the VSI. If the AC-associated authorized VSI is an isolated slave VSI, the data sent by the user device can only be forwarded within the same VLAN and cannot be forwarded across VXLAN tunnels.

[0085] Furthermore, the authentication request also includes: a VLAN tag and a MAC address;

[0086] Step S302: Create an AC according to the authentication response and associate the AC with the authorized VSI, including:

[0087] S302A: If the AC corresponding to the VLAN tag has been created, the association relationship between the AC and the authorized VSI is recorded in the MAC address table stored in the VTEP.

[0088] S302B: If the AC corresponding to the VLAN tag has not been created, create an AC according to the access interface, the VLAN tag, and the MAC address, and associate the AC with the authorized VSI.

[0089] After the AC is created, the association between the AC (or Ethernet service instance), VLAN tag, and authorized VSI is recorded in the MAC address table of the VTEP. In addition, the correspondence between the access interface and the MAC address of the user device is also recorded in the MAC address table.

[0090] After VTEP receives the access request sent by the user, it can obtain the source MAC address of the access request by parsing the access request, and search the MAC address table based on the source MAC address. If the corresponding MAC address table entry can be found, it can be considered that the user device has been authenticated and can be forwarded based on the destination MAC address; if the corresponding MAC address table entry cannot be found, it can be considered that the user device has not been authenticated, and it is necessary to initiate the authentication process to the authentication server, create an AC after the authentication is passed, and associate the authorized VSI with the AC.

[0091] The following describes a VSI association method involved in the present application in conjunction with a specific implementation. The network involved in the specific implementation is as follows: Figure 4 As shown, it includes VTEP, authentication server, switching device 1 to switching device 3 and user device 1 to user device 4. User device 1 and user device 2 belong to VLAN 10, user device 3 and user device 4 belong to VLAN 20, and VTEP belongs to VLAN 1. VLAN 1 is associated with VLAN 10 and VLAN 20. Among them, the switching device can also be called an access device, and the interface connecting the switching device and the VTEP is an AC port.

[0092] The authentication server records user information, including username and password. One username corresponds to two passwords, namely password 1 and password 2. Password 1 corresponds to the interoperable secondary VSI, and password 2 corresponds to the isolated secondary VSI. These two secondary VSIs are associated with the primary VSI. These two types of secondary VSIs are configured on the VTEP.

[0093] A VSI association method includes:

[0094] S1. The user device initiates an access request to the switching device, and the switching device forwards the access request to the VTEP.

[0095] Taking user device 1 as an example, after receiving the access request sent by user device 1, switching device 1 encapsulates the access request with a corresponding VLAN tag (VLAN 10) and forwards it to VTEP.

[0096] S2. VTEP records the access interface and parses the access request to obtain the VLAN tag and the carried MAC address.

[0097] The MAC address may be a source MAC address and a destination MAC address, wherein the MAC address of the user equipment refers to the source MAC address.

[0098] S3. VTEP searches the MAC address table according to the VLAN tag and the source MAC address. If the corresponding MAC address and VLAN tag are not found, step S4 is executed. If the corresponding MAC address and VLAN tag are found, forwarding is performed according to the record in the MAC address table.

[0099] S4. VTEP redirects the access request to the authentication page of the authentication server, and the user enters the user name and password to be authenticated through the user device.

[0100] S5. After the input is completed, the user device generates an authentication request according to the user name to be authenticated and the password to be authenticated entered by the user, and sends the authentication request to the authentication server through the switching device and VTEP.

[0101] At this time, the password to be authenticated is password 2, that is, the VLAN where the user device 1 is located needs to be set to isolation.

[0102] S6. The authentication server receives the authentication request and parses it, obtains the username and password to be authenticated carried in the authentication request, and matches them with the pre-stored user information. If the corresponding user information is found, S7 is executed. If not, the authentication request is considered to be illegal, and a rejection response is fed back to terminate the authentication process, or the authentication request is discarded.

[0103] S7. The authentication server obtains the VSI corresponding to the matched password as the authorized VSI and carries it in the authentication response, and feeds the authentication response back to the VTEP.

[0104] Since the password to be authenticated is password 2, the authorized VSI is the isolated slave VSI corresponding to password 2.

[0105] S8. The VTEP receives the authentication response and confirms that the user device has passed the authentication. It then creates an AC based on the access interface, VLAN tag, and MAC address of the user device, and associates the authorized VSI with the AC.

[0106] After the user device passes the authentication, an AC can be created on the downstream port of the VTEP, and the AC is associated with the isolated slave VSI.

[0107] When receiving a message that meets the forwarding rules configured by the AC, the MAC address table can be matched through the isolated slave VSI. Because under the configuration of the isolated slave VSI, messages with the same VLAN tag cannot be forwarded, and can only be forwarded in the upstream direction through VTEP, such as accessing the authentication server.

[0108] For other user devices (ie, user devices 2 to 4), the above process can be referred to to set the respective preset slave VSIs. Finally, user devices 1 and 2 are associated with isolated slave VSIs, and user devices 3 and 4 are associated with intercommunication slave VSIs, forming the following: Figure 5 The situation shown.

[0109] If user device 2 needs to be switched to authorize other VSIs, the user can cancel the login through user device 2, that is, clear the authentication recorded on the authentication server, or the user can directly access the redirected authentication page through user device 2 and re-enter the user name and password to be authenticated.

[0110] S9. The user device initiates an authentication request to the authentication server through the switching device and VTEP.

[0111] The password to be authenticated carried in this authentication request is password 1.

[0112] S10, the authentication server receives the authentication request and parses it, obtains the username and password to be authenticated carried in the authentication request, and matches them with the pre-stored user information. If the corresponding user information is found, S7 is executed. If not, the authentication request is considered to be illegal, and a rejection response is fed back to terminate the authentication process, or the authentication request is discarded.

[0113] Since the password to be authenticated is password 1, the authorized VSI is the intercommunication type slave VSI corresponding to password 1.

[0114] After the S8 process, an association is created between the AC and the interoperable secondary VSI, so that the user equipment 2 is switched to the interoperable secondary VSI. Figure 6 shown.

[0115] Correspondingly, the present application provides a VSI association device, such as Figure 7 As shown, it is applied to the authentication server and includes:

[0116] The transceiver unit is used to receive an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated;

[0117] A search unit, configured to search the stored user information according to the authentication request, wherein the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave virtual switching instance VSI, and the second password corresponds to an interoperable slave VSI;

[0118] The transceiver unit is further configured to send an authentication response carrying an authorized VSI corresponding to the password to be authenticated to the scalable virtual local area network tunnel endpoint VTEP if the authentication is passed, so that the VTEP associates the authorized VSI with the created AC.

[0119] Correspondingly, the present application provides a VSI association device, such as Figure 8 As shown in the figure, it is applied to VTEP and includes:

[0120] The transceiver unit is used to forward the authentication request to the authentication server, wherein the authentication request carries the input user name and password to be authenticated;

[0121] The transceiver unit is used to receive the authentication response fed back by the authentication server, wherein the authentication server stores user information, the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to the isolated slave VSI, the second password corresponds to the intercommunication slave VSI, the authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated;

[0122] The association unit is used to create an AC according to the authentication response and associate the AC with the authorized VSI.

[0123] Furthermore, the transceiver unit comprises:

[0124] A receiving module, used for receiving an access request sent by a user device;

[0125] The sending module is used to send an authentication request corresponding to the user equipment to the authentication server if the MAC address carried in the access request is not found in the media access control MAC address table; if the MAC address carried in the access request is found in the MAC address table, the access request is forwarded according to the MAC address.

[0126] Furthermore, the authentication request also includes: a virtual local area network VLAN tag and a MAC address;

[0127] The association unit is specifically used to associate the AC with the authorized VSI if the AC corresponding to the VLAN tag has been created, and forward the access request based on the VXLAN tunnel corresponding to the authorized VSI; if the AC corresponding to the VLAN tag has not been created, create the AC according to the access interface, VLAN tag and MAC address, and associate the AC with the authorized VSI.

[0128] Correspondingly, the present application provides a server, such as Fig. 9As shown, it includes a transceiver, a processor and a machine-readable storage medium, the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement any method step of the first aspect or any method step of the second aspect.

[0129] Correspondingly, the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to: implement any method step of the first aspect or any method step of the second aspect.

[0130] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0131] In the implementation manner of this specification, an isolated slave VSI and an interoperable slave VSI are configured on the authentication server, and the two slave VSIs are associated with different passwords. During the user authentication process, an AC is created to associate with the two VSIs respectively, so that the user can switch between the isolated slave VSI and the interoperable slave VSI, thereby improving the flexibility of switching between isolation and interoperability.

[0132] It should be understood that the present description is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

[0133] The above description is only a preferred implementation of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for associating a virtual switching instance, characterized in that: Applicable to authentication servers, including: Receiving an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated; Searching for stored user information according to the authentication request, wherein the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave virtual switching instance VSI, and the second password corresponds to an interoperable slave VSI; If the authentication is successful, an authentication response carrying the authorized VSI corresponding to the password to be authenticated is sent to the scalable virtual local area network tunnel endpoint VTEP, so that the VTEP associates the authorized VSI with the created AC.

2. The method according to claim 1, characterized in that After searching the stored user information according to the authentication request, the method further includes: If the authentication fails, the authentication request is discarded.

3. A method for associating a virtual switching instance, characterized in that: Applied to VTEP, including: Forwarding an authentication request to an authentication server, wherein the authentication request carries an input user name and password to be authenticated; Receive an authentication response fed back by the authentication server, wherein the authentication server stores user information, the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave VSI, the second password corresponds to an interoperable slave VSI, the authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated; An AC is created according to the authentication response, and the AC is associated with the authorized VSI.

4. The method according to claim 3, characterized in that The forwarding the authentication request to the authentication server comprises: receiving an access request sent by a user device; If the MAC address carried in the access request is not found in the media access control MAC address table, an authentication request corresponding to the user equipment is sent to an authentication server.

5. The method according to claim 4, characterized in that After receiving the access request sent by the user equipment, the method further includes: If the MAC address carried in the access request is found in the MAC address table, the access request is forwarded according to the MAC address.

6. The method according to claim 3, characterized in that The authentication request further includes: a virtual local area network VLAN tag and a MAC address; Creating an AC according to the authentication response and associating the AC with the authorized VSI includes: If the AC corresponding to the VLAN tag has been created, the association relationship between the AC and the authorized VSI is recorded in the MAC address table stored in the VTEP; If the AC corresponding to the VLAN tag is not created, an AC is created according to the access interface, the VLAN tag, and the MAC address, and the AC is associated with the authorized VSI.

7. A virtual exchange instance association device, characterized in that: Applicable to authentication servers, including: The transceiver unit is used to receive an authentication request from a user device, wherein the authentication request carries an input user name to be authenticated and a password to be authenticated; A search unit, configured to search the stored user information according to the authentication request, wherein the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave virtual switching instance VSI, and the second password corresponds to an interoperable slave VSI; The transceiver unit is further configured to send an authentication response carrying an authorized VSI corresponding to the password to be authenticated to the scalable virtual local area network tunnel endpoint VTEP if the authentication is passed, so that the VTEP associates the authorized VSI with the created AC.

8. A virtual exchange instance association device, characterized in that: Applied to VTEP, including: A transceiver unit, configured to forward an authentication request to an authentication server, wherein the authentication request carries an input user name and password to be authenticated; The transceiver unit is configured to receive an authentication response fed back by the authentication server, wherein the authentication server stores user information, the user information includes a user name and a password, the password includes a first password and a second password, the first password corresponds to an isolated slave VSI, the second password corresponds to an interoperable slave VSI, the authentication response carries an authorized VSI, and the authorized VSI corresponds to the password to be authenticated; An associating unit is configured to create an AC according to the authentication response, and associate the AC with the authorized VSI.

9. The device according to claim 8, characterized in that The transceiver unit comprises: A receiving module, used for receiving an access request sent by a user device; A sending module is used to send an authentication request corresponding to the user equipment to an authentication server if the MAC address carried in the access request is not found in the media access control MAC address table; if the MAC address carried in the access request is found in the MAC address table, forward the access request according to the MAC address.

10. The device according to claim 8, characterized in that The authentication request further includes: a VLAN tag and a MAC address; The association unit is specifically used to record the association relationship between the AC and the authorized VSI in the MAC address table stored in the VTEP if the AC corresponding to the VLAN tag has been created; if the AC corresponding to the VLAN tag has not been created, create the AC according to the access interface, the VLAN tag and the MAC address, and associate the AC with the authorized VSI.

11. A server, characterized in that: The method comprises a transceiver, a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1-2 or the method steps described in any one of claims 3-5.

12. A machine-readable storage medium, characterized in that: Machine executable instructions are stored, and when called and executed by a processor, the machine executable instructions prompt the processor to: implement the method steps described in any one of claims 1-2 or the method steps described in any one of claims 3-5.

Images