Tenant isolation service method, device, and electronic device

Abstract

The present application discloses a tenant isolation service method and device, which belongs to the field of communication technology. The method includes: the access network element parses the received SRv6 protocol message, obtains the SID carried in the message header and the Qinq information in the message as the tenant identification information; uses the tenant identification information as the index key, queries the pre-configured message forwarding table, determines the virtualized terminal device network element that matches the tenant identification information, and transmits the parsed message body and tenant identification information to the virtualized terminal device network element, so as to find the tenant configuration information that matches the tenant identification information according to the tenant identification information, and then, according to the tenant configuration information found, executes the network service that matches the message body for the corresponding tenant. This method uses SID and Qinq information as tenant identification information to isolate, store and retrieve the message forwarding table and tenant configuration information, thereby achieving effective isolation of tenant data and services.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a tenant isolation service method, device, electronic device, and computer-readable storage medium. Background Art

[0002] The network virtual switching system solution is to extend the user's indoor LAN to the cloud through the cloud gateway channel, converge all Internet traffic to the cloud gateway to achieve traffic forwarding and control, and implement fixed-point diversion according to user-related needs, such as cloud security, cloud entertainment, cloud storage, cloud IoT and other smart home services. The network virtual switching system transforms the cloud network access capability into a software service capability, moves the original optical modem's routing and switching capabilities to the network virtual switching system, and provides each broadband user with a routing network access method through the virtualization capability of the computing and processing equipment, with flexibility beyond the physical gateway. The network virtual switching system implemented through virtualization needs to have some network service functions of the optical modem. For example, the network virtual switching system needs to process data traffic from different users. How to achieve multi-tenant isolation in the network virtual switching system is a technical difficulty of virtualization. In addition, different tenant isolation service methods need to be provided for different access protocols.

[0003] In the prior art, no method has been found to simultaneously implement tenant isolation on both the WAN (Wide Area Network) side and the LAN (Local Area Network) side when accessing the SRv6 protocol. Summary of the invention

[0004] The embodiments of the present application provide a tenant isolation service method and device, which can implement multi-tenant isolation services on both the WAN side and the LAN side for the scenario of accessing the SRv6 protocol.

[0005] In a first aspect, an embodiment of the present application provides a tenant isolation service method, which is applied to a network virtual switching system, wherein the network virtual switching system includes: an access network element and a virtualized terminal device network element, and the method includes:

[0006] The access network element parses the received SRv6 protocol message to obtain tenant identification information, wherein the tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID;

[0007] The access network element uses the tenant identification information as an index key to query a pre-configured message forwarding table to determine a virtualized terminal device network element that matches the tenant identification information;

[0008] The access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element;

[0009] The virtualized terminal device network element searches for tenant configuration information matching the tenant identification information according to the tenant identification information;

[0010] The virtualized terminal device network element executes the network service matching the message body with the corresponding tenant identification information according to the found tenant configuration information.

[0011] Optionally, the access network element parses the received SRv6 protocol message to obtain tenant identification information, including:

[0012] The access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, and parses the original message of the SRv6 protocol message to obtain the tenant private network VLAN identifier and the operator network VLAN identifier;

[0013] The SID, the tenant private network VLAN identifier, and the operator network VLAN identifier are used together as tenant identification information carried in the SRv6 protocol message.

[0014] Optionally, the access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, including any one of the following methods:

[0015] The access network element parses the message header of the received SRv6 protocol message, and uses the last hop IP address carried in the message header as the SID;

[0016] The access network element parses the message header of the received SRv6 protocol message, and uses the Function field of the last hop IP address carried in the message header as the SID;

[0017] The access network element parses the message header of the received SRv6 protocol message, and uses the address bits obtained by addressing the preset network identifier of the tenant in the Function field of the last hop IP address carried in the message header as the SID.

[0018] Optionally, the access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, including:

[0019] The access network element carries the tenant identification information through a message extension space, encapsulates a message including a message body corresponding to the SRv6 protocol message, and transmits the encapsulated message to the determined virtualized terminal device network element.

[0020] Optionally, before the access network element parses the received SRv6 protocol message to obtain the tenant identification information, the method further includes:

[0021] A message forwarding table is stored in the access network element, wherein the index key of the message forwarding table is: the LAN side SID or WAN side SID of the corresponding tenant, and Qinq information, and the value is: a message forwarding mechanism carrying a virtualized terminal device network element identifier;

[0022] A tenant configuration information table is stored in the virtualized terminal device network element, wherein the index key of the tenant configuration information table is: the LAN side SID, WAN side SID, and Qinq information of the corresponding tenant, and the value is: the tenant configuration information of the corresponding tenant.

[0023] Optionally, the virtualized terminal device network element searches for tenant configuration information matching the tenant identification information according to the tenant identification information, including:

[0024] The virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information that matches the tenant identification information.

[0025] Optionally, the virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information matching the tenant identification information, including:

[0026] In response to the SRv6 protocol message being a control message, the virtualized terminal device network element uses the tenant identification information as an index key to query a pre-configured tenant configuration information table to determine the tenant configuration information;

[0027] In response to the SRv6 protocol message being a data message sent by the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table, and uses the converted tenant identification information as an index key to query the tenant configuration information table to determine the tenant configuration information;

[0028] In response to the SRv6 protocol message being a data message sent from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table and determine the tenant configuration information.

[0029] Optionally, the virtualized terminal device network element executes a network service matching the message body with respect to the corresponding tenant identification information according to the found tenant configuration information, including:

[0030] In response to the SID obtained through the analysis being a LAN side SID, the virtualized terminal device network element performs uplink traffic statistics based on the LAN side SID;

[0031] In response to the SID obtained through analysis being a WAN-side SID, the virtualized terminal device network element performs downlink traffic statistics based on the WAN-side SID.

[0032] In a second aspect, an embodiment of the present application provides a tenant isolation service device, which is applied to a network virtual switching system, wherein the network virtual switching system includes: an access network element and a virtualized terminal device network element, and the device includes:

[0033] A tenant identification information acquisition module, configured to obtain tenant identification information by parsing the received SRv6 protocol message through the access network element, wherein the tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID;

[0034] A virtualized terminal device network element determination module, configured to query a pre-configured message forwarding table through the access network element using the tenant identification information as an index key to determine a virtualized terminal device network element that matches the tenant identification information;

[0035] An information transmission module, configured to transmit the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element through the access network element;

[0036] A tenant configuration information search module, used to search for tenant configuration information matching the tenant identification information according to the tenant identification information through the virtualized terminal device network element;

[0037] The tenant isolation service module is used to execute the network service matching the message body for the corresponding tenant identification information according to the tenant configuration information found through the virtualized terminal device network element.

[0038] Optionally, the tenant identification information acquisition module is further used to:

[0039] The access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, and parses the original message of the SRv6 protocol message to obtain the tenant private network VLAN identifier and the operator network VLAN identifier;

[0040] The SID, the tenant private network VLAN identifier, and the operator network VLAN identifier are used together as tenant identification information carried in the SRv6 protocol message.

[0041] Optionally, the access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, including any one of the following methods:

[0042] The access network element parses the message header of the received SRv6 protocol message, and uses the last hop IP address carried in the message header as the SID;

[0043] The access network element parses the message header of the received SRv6 protocol message, and uses the Function field of the last hop IP address carried in the message header as the SID;

[0044] The access network element parses the message header of the received SRv6 protocol message, and uses the address bit obtained by addressing the preset network identifier of the tenant in the Function field of the last hop IP address carried by the message header as the SID.

[0045] Optionally, the information transmission module is further used to:

[0046] The access network element carries the tenant identification information through a message extension space, encapsulates a message including a message body corresponding to the SRv6 protocol message, and transmits the encapsulated message to the determined virtualized terminal device network element.

[0047] Optionally, the device further comprises: a configuration module,

[0048] The configuration module is used to store a message forwarding table in the access network element, wherein the index key of the message forwarding table is: the LAN side SID or WAN side SID of the corresponding tenant, and Qinq information, and the value is: a message forwarding mechanism carrying a virtualized terminal device network element identifier;

[0049] The configuration module is also used to store a tenant configuration information table in the virtualized terminal device network element, wherein the index key of the tenant configuration information table is: the LAN side SID, WAN side SID, and Qinq information of the corresponding tenant, and the value is: the tenant configuration information of the corresponding tenant.

[0050] Optionally, the tenant configuration information search module is further used to:

[0051] The virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information that matches the tenant identification information.

[0052] Optionally, the virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information matching the tenant identification information, including:

[0053] In response to the SRv6 protocol message being a control message, the virtualized terminal device network element uses the tenant identification information as an index key to query a pre-configured tenant configuration information table to determine the tenant configuration information;

[0054] In response to the SRv6 protocol message being a data message sent by the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table, and uses the converted tenant identification information as an index key to query the tenant configuration information table to determine the tenant configuration information;

[0055] In response to the SRv6 protocol message being a data message sent from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table and determine the tenant configuration information.

[0056] Optionally, the tenant isolation service module is further used to:

[0057] In response to the SID obtained through the analysis being a LAN side SID, the virtualized terminal device network element performs uplink traffic statistics based on the LAN side SID;

[0058] In response to the SID obtained through analysis being a WAN-side SID, the virtualized terminal device network element performs downlink traffic statistics based on the WAN-side SID.

[0059] In a third aspect, an embodiment of the present application further discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the tenant isolation service method described in the embodiment of the present application when executing the computer program.

[0060] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the tenant isolation service method disclosed in the embodiment of the present application are performed.

[0061] The tenant isolation service method disclosed in the embodiment of the present application is applied to a network virtual switching system, wherein the network virtual switching system includes: an access network element and a virtualized terminal device network element. The method addresses the SID in the message header of the SRv6 protocol message by using the SID and Qinq information as tenant identification information. In this way, the access network element parses the received SRv6 protocol message, obtains the SID carried in the SRV6 protocol message header and the Qinq information in the message, and obtains the tenant identification information; then, further using the tenant identification information as an index key, querying a pre-configured message forwarding table, determining a virtualized terminal device network element matching the tenant identification information, and transmitting the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, and the virtualized terminal device network element searches for the tenant configuration information matching the tenant identification information according to the tenant identification information. Then, according to the tenant configuration information found, the network service matching the message body for the corresponding tenant is executed, thereby effectively realizing the tenant isolation service in the access SRv6 protocol scenario.

[0062] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0064] Figure 1 This is one of the flow charts of the tenant isolation service method in the embodiment of the present application;

[0065] Figure 2 It is a schematic diagram of the application system architecture of the tenant isolation service method in the embodiment of the present application;

[0066] Figure 3 This is the second flowchart of the tenant isolation service method in the embodiment of the present application;

[0067] Figure 4 It is one of the structural schematic diagrams of the tenant isolation service device in the embodiment of the present application;

[0068] Figure 5 This is the second structural diagram of the tenant isolation service device in the embodiment of the present application;

[0069] Figure 6 A block diagram schematically shows an electronic device for executing the method according to the present application; and

[0070] Figure 7 A storage unit for holding or carrying a program code for implementing the method according to the present application is schematically shown. DETAILED DESCRIPTION

[0071] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0072] like Figure 1 As shown, a tenant isolation service method disclosed in an embodiment of the present application is applied to a network virtual switching system, and the method includes: steps 110 to 150.

[0073] See also Figure 2 The network virtual switching system includes: an access network element (i.e., vSwitch) 210 and at least one virtualized terminal equipment network element 220 (virtual Customer Premise Equipment, hereinafter referred to as "vCPE"). Each virtualized terminal equipment network element 220 can process network functions related to network services for several tenants. During the operation of the network virtual switching system, the access network element 210 is used to receive and send SRv6 messages and forward messages.

[0074] Combine the following Figure 2 The network virtual switching system shown is used to illustrate the specific implementation scheme of the tenant isolation service method disclosed in the embodiments of the present application.

[0075] Step 110: The access network element parses the received SRv6 protocol message to obtain tenant identification information.

[0076] The tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID.

[0077] Before the tenant broadband is activated, the network management personnel will plan according to the tenant community network environment, plan the LAN side SID and WAN side SID available to the tenant, as well as the tenant private network VLAN ID and the operator network VLAN ID, and configure the tenant configuration information for the tenant to ensure user access to network services.

[0078] The network virtual switching system is a channel for tenants (i.e., network service users) and cloud servers to communicate over the network. When a tenant accesses an Internet service through a terminal device, the terminal device will generate a corresponding request and send it to the network virtual switching system. The network virtual switching system will generate a message according to the preset protocol and link hierarchy. After that, the network virtual switching system will send the generated message to the designated server and transmit it in the cloud. At the same time, the network virtual switching system also processes the received messages, and by parsing and distributing the received messages, the tenant's terminal device can receive messages fed back or pushed by the cloud service. In this process, the network virtual switching system can access different protocols. This application describes the tenant isolation service method performed by the network virtual switching system for the scenario where the network virtual switching system accesses the SRv6 protocol.

[0079] In some embodiments of the present application, the access network element parses the received SRv6 protocol message to obtain tenant identification information, including: the access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, and parses the original message of the SRv6 protocol message to obtain the tenant private network VLAN identifier and the operator network VLAN identifier; the SID, the tenant private network VLAN identifier, and the operator network VLAN identifier are used together as the tenant identification information carried in the SRv6 protocol message.

[0080] In order to identify the network session, the tenant's terminal device and the network server need to carry tenant identification information for distinguishing different tenants in the message exchanged between them. In the embodiment of the present application, the tenant's SID is carried in the SRv6 message header, and the tenant's Qinq information is carried in the original message, so as to carry the tenant identification information in the message.

[0081] SRv6 technology uses the existing IPv6 forwarding technology to implement label forwarding-like processing by extending the header field of the IPv6 message. In SRv6, each Segment is identified by SID (Segment ID). SID is a special IPv6 address that has both the routing capabilities of ordinary IPv6 addresses and the behavior capabilities unique to SRv6. Each SRv6 node maintains a SID table (actually part of the routing table), which consists of many 128-bit SIDs. The standard format of SID is: Locator+Function(Args). In some embodiments of the present application, when generating a message, the tenant's SID is compiled into the last-hop destination address of the message header of the SRv6 protocol message to achieve the transmission of the tenant's SID in the network.

[0082] It is known from the prior art that in IPv6 with SRH (Segment Routing Header), that is, SR message header, the IPv6 address of each hop is encapsulated in SRH to control the message forwarding path. In an embodiment of the present application, the IP address of the tenant, that is, the destination address of the message, can be used as the tenant's SID as a whole and encapsulated in the last-hop IP address of the SRH. In other embodiments of the present application, the tenant's preset network identifier (the tenant's unique identity in the WAN network, such as VxLAND ID) can also be addressed as the specified address bits (such as the first 28 bits) of the Function field in the last-hop IP address of the SRH, thereby realizing the transmission of tenant identification information in the message. In some embodiments of the present application, other unique identifiers of the tenant can also be addressed in the entire Function field.

[0083] Accordingly, after receiving a message, the SRv6 protocol message needs to be parsed according to the parsing method corresponding to the SID compilation method to obtain the last hop destination address of the message header, thereby obtaining the tenant's SID.

[0084] In some embodiments of the present application, the access network element parses the last hop IP address of the header of the received SRv6 protocol message to obtain the SID, including any of the following methods: the access network element parses the header of the received SRv6 protocol message, and uses the last hop IP address carried in the header as the SID; the access network element parses the header of the received SRv6 protocol message, and uses the Function field of the last hop IP address carried in the header as the SID; the access network element parses the header of the received SRv6 protocol message, and uses the address bits (such as the first 28 bits of the aforementioned Function field) obtained by addressing the preset network identifier of the tenant in the Function field of the last hop IP address carried in the header as the SID. The method of parsing the header of the SRv6 protocol message to obtain the SID corresponds to the method of addressing the SID of the last hop in the header. The method of parsing the header refers to the aforementioned addressing method, which will not be repeated here.

[0085] According to the above method, the SID carried in the message header can be obtained. If the message is from the WAN side, the SID carried in the message header is the WAN side SID of the corresponding tenant; if the message is from the LAN side, the SID carried in the message header is the LAN side SID of the corresponding tenant.

[0086] Furthermore, by further decapsulating the message, the Qinq information carried in the original message can be parsed to obtain the tenant private network VLAN ID PVLAN_ID and the operator network VLAN ID CVLAN_ID.

[0087] In an embodiment of the present application, the SID and Qinq information parsed from the message is used as tenant identification information for distinguishing tenants.

[0088] Step 120: The access network element uses the tenant identification information as an index key to query a pre-configured message forwarding table to determine a virtualized terminal device network element that matches the tenant identification information.

[0089] As mentioned above, before the tenant broadband is activated, the network management personnel of the operator will plan the LAN side SID and WAN side SID available to the tenant according to the tenant community network environment, as well as Qinq information (for example, the tenant private network VLAN ID, i.e. PVLAN_ID, and the operator network VLAN ID, i.e. CVLAN_ID), etc., and configure the tenant configuration information for the tenant to ensure the user's access to the network service. This is used for subsequent query in the message forwarding and network service processing stages.

[0090] like Figure 3As shown, before the access network element parses the received SRv6 protocol message to obtain the tenant identification information, the method also includes: step 100.

[0091] Step 100, storing a message forwarding table in the access network element, wherein the index key of the message forwarding table is: the LAN side SID or WAN side SID of the corresponding tenant, and Qinq information, and the value is: a message forwarding mechanism carrying a virtualized terminal device network element identifier.

[0092] For example, before the tenant broadband is activated, the network administrator plans the available LAN side SID, WAN side SID, and Qinq information according to the tenant community network environment. The Qinq information includes: the operator network VLAN ID, namely CVLAN_ID, and the tenant private network VLAN ID, namely PVLAN_ID.

[0093] QinQ technology encapsulates a VLAN Tag of an operator network before the user message enters the operator network, and treats the original VLAN Tag in the user message as data, so that the message passes through the operator network with two layers of VLAN Tags. In the embodiment of the present application, SID+Qinq information is used as tenant identification information.

[0094] The network management personnel can configure the access network element by sending configuration signaling or in the form of command lines to trigger the access network element to store a message forwarding table including a plurality of table entries in a local data storage unit.

[0095] The message forwarding table uses SID+Qinq information (i.e., including SID, operator network VLAN ID CVLAN_ID, and tenant private network VLAN ID PVLAN_ID) as the index key and message forwarding mechanism as the value. The message forwarding mechanism at least includes the network element ID that needs to forward the message to the vCPE network element for processing.

[0096] In an embodiment of the present application, the message forwarding table includes an uplink message forwarding table and a downlink message forwarding table. In the uplink message forwarding table, the SID is the tenant's WAN side SID, and in the downlink message forwarding table, the SID is the tenant's LAN side SID.

[0097] In some embodiments of the present application, the network virtual switching system provides a fast query interface for the message forwarding table. The fast query interface is a KEY:VALUE fast search algorithm, where KEY is composed of tenant identification information SID+Qinq information, and VALUE is the index of the forwarding table. The function of the message forwarding table is to query the forwarding table of the message through the tenant identification information, thereby guiding the message forwarding according to the forwarding table.

[0098] During the message interaction process, for the message received from the WAN side, the access network element 310 parses the tenant identification information carried in the message, and then schedules the traffic according to the pre-configured message forwarding table, for example, re-encapsulating the message and forwarding it to the specified virtualized terminal device network element 320. After that, the virtualized terminal device network element 320 completes the network function processing of the tenant traffic according to the message sent by the access network element 310. For another example, for the message received from the LAN side, the access network element 310 encapsulates the message and then sends the message according to the link address specified in the message.

[0099] After obtaining the tenant identification information by parsing the message, the access network element further queries the pre-configured message forwarding table based on the tenant identification information to determine the virtualized terminal device network element that matches the tenant identification information. For example, a quick query interface for the message forwarding table can be provided by the network virtual switching system, and the obtained tenant identification information is used as a KEY to query the corresponding VALUE, that is, the index of the forwarding table. Furthermore, the message forwarding mechanism of the corresponding tenant is obtained through the index of the forwarding table. In some embodiments of the present application, the message forwarding mechanism includes at least an identifier of the vCPE, which is used to guide the access network element to send the message information to the corresponding vCPE network element (i.e., the virtualized terminal device network element) for processing.

[0100] Step 130: The access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element.

[0101] After determining the destination virtualized terminal device network element for message forwarding, the access network element further decapsulates the SRv6 protocol message to obtain the message body, together with the tenant identification information, and sends it to the determined virtualized terminal device network element, which performs subsequent network service function processing.

[0102] In some embodiments of the present application, the access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, including: the access network element carries the tenant identification information through the message extension space, encapsulates the message including the message body corresponding to the SRv6 protocol message, and transmits the encapsulated message to the determined virtualized terminal device network element.

[0103] In the embodiments of the present application, a high-speed virtual interface connection can be implemented using shared memory between the access network element and the vCPE network element. The message received by the vCPE network element no longer carries the SRv6 header. The vCPE needs to obtain the tenant SID. At the same time, the access network element also needs to obtain the SID after the vCPE performs LAN and WAN conversion. In order to transmit the SID between network elements, in some embodiments of the present application, the tenant identification information such as the SID is transmitted by means of message extension. For example, the tenant identification information can be extended to the end of the payload of the message to realize information transmission between the two network elements.

[0104] In this way, the message body obtained by parsing the SRv6 protocol message and the tenant identification information can be transmitted to the designated vCPE network element through a high-speed virtual interface connection (such as shared memory, or so-called "message cache").

[0105] In some embodiments of the present application, other methods may also be used to implement information transmission between network elements (such as access network elements and vCPE network elements) in a network virtual switching system, which will not be listed one by one in this embodiment.

[0106] Step 140: The virtualized terminal device network element searches for tenant configuration information that matches the tenant identification information based on the tenant identification information.

[0107] The vCPE network element can obtain the message through the aforementioned high-speed virtual interface connection (such as shared memory, i.e., message cache), and obtain the tenant identification information through the message extension space in the message. After that, the tenant identification information is further used as the KEY to query the tenant configuration information table item, obtain the table item that matches the KEY (i.e., tenant identification information), and obtain the tenant configuration information in the table item.

[0108] The tenant configuration information table items are pre-configured by the network management personnel of the operator and stored in the virtualized terminal device network element.

[0109] In some embodiments of the present application, Figure 3 As shown, before the access network element parses the received SRv6 protocol message to obtain the tenant identification information, the method also includes: step 102.

[0110] Step 102, storing a tenant configuration information table in the virtualized terminal device network element, wherein the index key of the tenant configuration information table is: the LAN side SID, WAN side SID, and Qinq information of the corresponding tenant, and the value is: the tenant configuration information of the corresponding tenant.

[0111] In some embodiments of the present application, the network administrator can configure the virtualized terminal device network element by sending configuration signaling or in the form of a command line to trigger the virtualized terminal device network element to store a tenant configuration information table including several table items in the local data storage unit. Each table item corresponds to the tenant configuration information related to the network service of a tenant, and the tenant configuration information includes but is not limited to: the operating parameters and operating environment of each network service function module.

[0112] For example, before the tenant broadband is activated, the network administrator will also create a tenant account for the tenant in the network communication system. The tenant account refers to the tenant's dial-up account. After that, the network administrator further configures a series of configuration information for the tenant account to ensure the tenant's normal Internet access, such as PPPOE, DHCP, NAT, message forwarding table, SRv6 strategy, etc., and then stores the tenant account and tenant configuration information in the network virtual switching system through signaling.

[0113] In some embodiments of the present application, in a network virtual switching system, a tenant configuration information table item corresponding to a corresponding tenant is generated according to the tenant configuration information configured by a network administrator, and stored in a data storage unit of a virtualized terminal device network element. The tenant configuration information table item records the association between the tenant's LAN side SID and WAN side SID and the tenant account of the tenant. For example, one of the table items is a hash table item with the tenant account as the KEY, and the other table item is a bihash table item with SID and Qinq (i.e., PVLAN_ID and CVLAN_ID) as the KEY. The value (VALUE) of the table item corresponds to the tenant configuration information of each network service node. The tenant configuration information is stored in two hash table items according to the account uniqueness and tenant identification information (i.e., SID, PVLAN_ID (PVLAN is private VLAN (Private VLAN)) and CVLAN_ID uniqueness), thereby realizing the isolated storage of the tenant configuration information. By saving two table items of tenant configuration information, it is convenient to use in different scenarios.

[0114] In some embodiments of the present application, the virtualized terminal device network element searches for tenant configuration information that matches the tenant identification information based on the tenant identification information, including: the virtualized terminal device network element determines an index key based on the tenant identification information, queries a pre-configured tenant configuration information table, and determines the tenant configuration information that matches the tenant identification information.

[0115] As mentioned above, the tenant identification information is carried by the message extension field, and accordingly, the virtualized terminal device network element needs to obtain the tenant identification information from the private field of the message cache. The message cache can be a shared cache for each network element in the network virtual switching system to transmit messages, or other high-speed virtual interface connections. For example, the virtualized terminal device network element can obtain the tenant identification information through the payload tail of the message.

[0116] After obtaining the tenant identification information, the virtualized terminal equipment network element vCPE can further obtain the tenant configuration information of the corresponding tenant based on the tenant identification information, so as to perform subsequent network service function processing.

[0117] In some embodiments of the present application, the virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines the tenant configuration information that matches the tenant identification information, including: in response to the SRv6 protocol message being a control message, the virtualized terminal device network element uses the tenant identification information as an index key to query a pre-configured tenant configuration information table to determine the tenant configuration information; in response to the SRv6 protocol message being a data message sent from the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table to determine the tenant configuration information; in response to the SRv6 protocol message being a data message sent from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table to determine the tenant configuration information.

[0118] In specific implementation, the message transmitted by the access network element to the virtualized terminal device network element may be a message from a wide area network (i.e., a WAN network) or a message from a local area network (i.e., a LAN network). As mentioned above, the SIDs carried in messages from different network environments are different, that is, messages from the WAN network carry the tenant's WAN side SID, and messages from the LAN network carry the tenant's LAN side SID. The virtualized terminal device network element needs to convert the SID carried in the message according to the message source and message type, convert the SID in the message into a SID that can be recognized by the next node, and then send it to the next node for further processing.

[0119] For example, when the message is a data message from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table item; then, the converted LAN side SID and the Qinq information in the tenant identification information are used as the converted tenant identification information; then, the converted tenant identification information is used as a KEY to search for the pre-set tenant configuration information table item to obtain the tenant configuration information.

[0120] For another example, when the message is a data message from the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table item; then, the converted WAN side SID and the Qinq information in it are used as the converted tenant identification information; then, the converted tenant identification information is used as a KEY to search for the pre-set tenant configuration information table item to obtain the tenant configuration information.

[0121] When the message is a control message, no SID conversion is required.

[0122] Step 150: The virtualized terminal device network element executes a network service matching the message body with respect to the corresponding tenant identification information according to the found tenant configuration information.

[0123] Next, the virtualized terminal device network element calls the corresponding network service function module according to the message type matched by the message body, and the network service function module executes the network service matching the message body for the corresponding tenant according to the found tenant configuration information.

[0124] In some embodiments of the present application, when a control message is received, the virtualized terminal device network element forwards the control message to a corresponding node for processing according to the tenant configuration information found and the message type, and transmits the tenant identification information to the corresponding node. The corresponding node executes a network service for the tenant identification information and matching the message body.

[0125] In some embodiments of the present application, the network service includes one or more of the following: PPPOE dial-up service, DHCP service, and ARP table entry management service.

[0126] In some embodiments of the present application, the virtualized terminal device network element may further include: a data I / O unit, a data forwarding unit, a service processing unit, a data storage unit, and a signaling unit. The data I / O unit is responsible for receiving and sending data; the data forwarding unit is connected to the data I / O unit; the service processing unit is connected to the data forwarding unit; the data storage unit is connected to the signaling unit; and the service processing unit can access or write to the data storage unit.

[0127] Furthermore, the data storage unit is used to isolate and save the data set of the multi-tenant account table items, and provide the business processing unit with a quick query interface for distinguishing multiple tenants. When the tenant broadband is installed, the tenant's network environment has been planned and determined at this time; and the tenant's SID and Qinq information, that is, the tenant identification information, and the tenant identification information will not change during the tenant's use of the network. In the data storage unit, the tenant account or tenant identification information can be bound to the tenant configuration information by storing a KEY: VALUE pair, so that a KEY: VALUE pair is maintained for each tenant who activates broadband, thereby realizing the isolation and preservation of tenant configuration information items for different tenant accounts. In addition, the data storage unit can isolate and maintain the tenant configuration information items based on the KEY (that is, the tenant identification information).

[0128] The data forwarding unit is used for scheduling and processing multi-tenant data flows, and dispatches messages to corresponding service processing units according to different message protocol types. The service processing unit includes DHCP servers such as DHCPv4 server, DHCPv6 server, PPPOE dial-up server, ARP entry management service and other LAN side functional modules.

[0129] The business processing unit queries the terminal status in the multi-tenant account table to guide subsequent business processing. When the tenant's terminal device needs to respond to processing, it applies for a response message and forwards it through the data forwarding unit. After that, the business processing unit obtains the tenant identification information from the message as a key, queries the tenant configuration information table to find the VALUE value, and then performs differentiated message processing according to the tenant configuration information in the table, thereby realizing the isolation processing of different tenant messages.

[0130] For example, the DHCPv4 server allocates IP4 addresses to the tenant's terminal devices, identifies and changes the status of the tenant's terminal devices, and maintains information such as changes; the DHCPv6 server allocates IP6 addresses to the tenant's terminal devices, identifies and changes the status of the tenant's terminal devices, and maintains information such as changes; the ARP service module performs ARP learning of the tenant's terminal devices through the PPPOE interface, and uses the LAN side gateway mac address to send ARP response packets to the user, etc.

[0131] In some embodiments of the present application, the virtualized terminal device network element executes a network service that matches the message body for the corresponding tenant identification information according to the tenant configuration information found, including: in response to the SID obtained by parsing being a LAN side SID, the virtualized terminal device network element performs upstream traffic statistics based on the LAN side SID; in response to the SID obtained by parsing being a WAN side SID, the virtualized terminal device network element performs downstream traffic statistics based on the WAN side SID. For example, for a message received from the WAN side, the virtualized terminal device network element can identify the tenant based on the WAN side SID and Qinq parsed from the message, and perform statistics on the tenant's downstream traffic. For another example, for a message sent to the WAN side, the virtualized terminal device network element can identify the tenant based on the LAN side SID and Qinq parsed from the message, and perform statistics on the tenant's upstream traffic.

[0132] In some embodiments of the present application, the traffic statistics operation may be performed by a data forwarding unit in a virtualized terminal device network element.

[0133] The tenant isolation service method disclosed in the embodiment of the present application is applied to a network virtual switching system, wherein the network virtual switching system includes: an access network element and a virtualized terminal device network element. The method addresses the SID in the message header of the SRv6 protocol message by using the SID and Qinq information as tenant identification information. In this way, the access network element parses the received SRv6 protocol message, obtains the SID carried in the SRv6 protocol message header and the Qinq information in the message, and obtains the tenant identification information; then, further using the tenant identification information as an index key, querying a pre-configured message forwarding table, determining a virtualized terminal device network element matching the tenant identification information, and transmitting the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, and the virtualized terminal device network element searches for the tenant configuration information matching the tenant identification information according to the tenant identification information. Then, according to the tenant configuration information found, the network service matching the message body for the corresponding tenant is executed, thereby effectively realizing the tenant isolation service in the access SRv6 protocol scenario.

[0134] The tenant isolation service method disclosed in the embodiment of the present application is a method in which each network service function module inside a virtualized terminal device network element distinguishes different tenants based on tenant identification information composed of SID and Qinq information, and uses the tenant identification information as an index to store tenant configuration information, distribute and count tenant traffic, maintain tenant status, and search data storage units, thereby realizing data storage isolation, data processing isolation, and traffic statistics isolation for multiple tenants.

[0135] By planning WAN-side SID and LAN-side SID for tenants and using Qinq as tenant identification information, you can further perform separate statistics on the tenant's upstream and downstream traffic.

[0136] The tenant isolation service device disclosed in the embodiment of the present application is applied to Figure 2 The network virtual switching system shown in the figure includes: an access network element and a virtualized terminal device network element. Figure 4 As shown, the device comprises:

[0137] The tenant identification information acquisition module 410 is used to parse the received SRv6 protocol message through the access network element to obtain the tenant identification information, wherein the tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID;

[0138] A virtualized terminal device network element determination module 420, configured to query a pre-configured message forwarding table through the access network element using the tenant identification information as an index key to determine a virtualized terminal device network element matching the tenant identification information;

[0139] An information transmission module 430 is used to transmit the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element through the access network element;

[0140] A tenant configuration information search module 440, configured to search for tenant configuration information matching the tenant identification information according to the tenant identification information through the virtualized terminal device network element;

[0141] The tenant isolation service module 450 is used to execute the network service matching the message body for the corresponding tenant identification information according to the found tenant configuration information through the virtualized terminal device network element.

[0142] In some embodiments of the present application, the tenant identification information acquisition module 410 is further used to:

[0143] The access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, and parses the original message of the SRv6 protocol message to obtain the tenant private network VLAN identifier and the operator network VLAN identifier;

[0144] The SID, the tenant private network VLAN identifier, and the operator network VLAN identifier are used together as tenant identification information carried in the SRv6 protocol message.

[0145] In some embodiments of the present application, the access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, including any one of the following methods:

[0146] The access network element parses the message header of the received SRv6 protocol message, and uses the last hop IP address carried in the message header as the SID;

[0147] The access network element parses the message header of the received SRv6 protocol message, and uses the Function field of the last hop IP address carried in the message header as the SID;

[0148] The access network element parses the message header of the received SRv6 protocol message, and uses the address bit obtained by addressing the preset network identifier of the tenant in the Function field of the last hop IP address carried by the message header as the SID.

[0149] In some embodiments of the present application, the information transmission module 430 is further used to:

[0150] The access network element carries the tenant identification information through a message extension space, encapsulates a message including a message body corresponding to the SRv6 protocol message, and transmits the encapsulated message to the determined virtualized terminal device network element.

[0151] In some embodiments of the present application, Figure 5 As shown, the device further includes: a configuration module 400,

[0152] The configuration module 400 is used to store a message forwarding table in the access network element, wherein the index key of the message forwarding table is: the LAN side SID or WAN side SID of the corresponding tenant, and Qinq information, and the value is: a message forwarding mechanism carrying a virtualized terminal device network element identifier;

[0153] The configuration module 400 is also used to store a tenant configuration information table in the virtualized terminal device network element, wherein the index key of the tenant configuration information table is: the LAN side SID, WAN side SID, and Qinq information of the corresponding tenant, and the value is: the tenant configuration information of the corresponding tenant.

[0154] In some embodiments of the present application, the tenant configuration information search module 440 is further used to:

[0155] The virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information that matches the tenant identification information.

[0156] In some embodiments of the present application, the virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information matching the tenant identification information, including:

[0157] In response to the SRv6 protocol message being a control message, the virtualized terminal device network element uses the tenant identification information as an index key to query a pre-configured tenant configuration information table to determine the tenant configuration information;

[0158] In response to the SRv6 protocol message being a data message sent by the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table, and uses the converted tenant identification information as an index key to query the tenant configuration information table to determine the tenant configuration information;

[0159] In response to the SRv6 protocol message being a data message sent from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table and determine the tenant configuration information.

[0160] In some embodiments of the present application, the tenant isolation service module 450 is further used to:

[0161] In response to the SID obtained through the analysis being a LAN side SID, the virtualized terminal device network element performs uplink traffic statistics based on the LAN side SID;

[0162] In response to the SID obtained through analysis being a WAN-side SID, the virtualized terminal device network element performs downlink traffic statistics based on the WAN-side SID.

[0163] The tenant isolation service device disclosed in the embodiment of the present application is used to implement the tenant isolation service method described in the embodiment of the present application. The specific implementation methods of each module of the device will not be repeated here, and the specific implementation methods of the corresponding steps in the method embodiment can be referred to.

[0164] A tenant isolation service device disclosed in an embodiment of the present application is applied to a network virtual switching system, the network virtual switching system comprising: an access network element and a virtualized terminal device network element, the device addresses the SID in the message header of the SRv6 protocol message by using the SID and Qinq information as tenant identification information, so that the access network element parses the received SRv6 protocol message, obtains the SID carried in the SRv6 protocol message header and the Qinq information in the message, and obtains the tenant identification information; then, further using the tenant identification information as an index key, querying a pre-configured message forwarding table, determining a virtualized terminal device network element matching the tenant identification information, and transmitting the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, the virtualized terminal device network element searches for the tenant configuration information matching the tenant identification information according to the tenant identification information, and then, according to the tenant configuration information found, executes the network service matching the message body for the corresponding tenant, thereby effectively realizing the tenant isolation service in the access SRv6 protocol scenario.

[0165] The tenant isolation service device disclosed in the embodiment of the present application virtualizes the various network service function modules inside the terminal device network element to distinguish different tenants based on tenant identification information composed of SID and Qinq information, and uses the tenant identification information as an index to store tenant configuration information, distribute and count tenant traffic, maintain tenant status, and search data storage units, thereby realizing data storage isolation, data processing isolation, and traffic statistics isolation for multiple tenants.

[0166] By planning WAN-side SID and LAN-side SID for tenants and using Qinq as tenant identification information, you can further perform separate statistics on the tenant's upstream and downstream traffic.

[0167] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0168] The above is a detailed introduction to a tenant isolation service method and device provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, based on the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0169] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0170] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the electronic device according to the embodiment of the present application. The present application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0171] For example, Figure 6An electronic device that can implement the method according to the present application is shown. The electronic device can be a PC, a mobile terminal, a personal digital assistant, a tablet computer, etc. The electronic device traditionally includes a processor 610 and a memory 620 and a program code 630 stored on the memory 620 and can be run on the processor 610, and the processor 610 implements the method described in the above embodiment when executing the program code 630. The memory 620 can be a computer program product or a computer-readable medium. The memory 620 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 620 has a storage space 6201 for the program code 630 of a computer program for executing any method step in the above method. For example, the storage space 6201 for the program code 630 can include various computer programs for implementing the various steps in the above method respectively. The program code 630 is a computer-readable code. These computer programs can be read from one or more computer program products or written into the one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. The computer program includes a computer readable code, and when the computer readable code is executed on an electronic device, the electronic device is caused to execute the method according to the above embodiment.

[0172] An embodiment of the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the tenant isolation service method as described in the first embodiment of the present application are implemented.

[0173] Such a computer program product may be a computer-readable storage medium, which may have a computer-readable storage medium having a Figure 6 The memory 620 in the electronic device shown in the figure is similar to the storage segment, storage space, etc. The program code can be compressed and stored in the computer-readable storage medium in an appropriate form. The computer-readable storage medium is generally as shown in the reference Figure 7 The portable or fixed storage unit. Generally, the storage unit includes computer readable code 630', which is a code read by a processor. When the code is executed by the processor, each step in the method described above is implemented.

[0174] The term "one embodiment", "embodiment" or "one or more embodiments" herein means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. In addition, please note that the examples of the term "in one embodiment" here do not necessarily all refer to the same embodiment.

[0175] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0176] In the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0177] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A tenant isolation service method, applied to a network virtual switching system, characterized in that: The network virtual switching system includes: an access network element and a virtualized terminal device network element, and the method includes: The access network element parses the received SRv6 protocol message to obtain tenant identification information, wherein the tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID; The access network element uses the tenant identification information as an index key to query a pre-configured message forwarding table to determine a virtualized terminal device network element that matches the tenant identification information; The access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element; The virtualized terminal device network element searches for tenant configuration information matching the tenant identification information according to the tenant identification information; The virtualized terminal device network element executes the network service matching the message body with the corresponding tenant identification information according to the found tenant configuration information.

2. The method according to claim 1, characterized in that The access network element parses the received SRv6 protocol message to obtain tenant identification information, including: The access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, and parses the original message of the SRv6 protocol message to obtain the tenant private network VLAN identifier and the operator network VLAN identifier; The SID, the tenant private network VLAN identifier, and the operator network VLAN identifier are used together as tenant identification information carried in the SRv6 protocol message.

3. The method according to claim 2, characterized in that The access network element parses the last hop IP address of the message header of the received SRv6 protocol message to obtain the SID, including any one of the following methods: The access network element parses the message header of the received SRv6 protocol message, and uses the last hop IP address carried in the message header as the SID; The access network element parses the message header of the received SRv6 protocol message, and uses the Function field of the last hop IP address carried in the message header as the SID; The access network element parses the message header of the received SRv6 protocol message, and uses the address bits obtained by addressing the preset network identifier of the tenant in the Function field of the last hop IP address carried in the message header as the SID.

4. The method according to any one of claims 1 to 3, characterized in that: The access network element transmits the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element, including: The access network element carries the tenant identification information through a message extension space, encapsulates a message including a message body corresponding to the SRv6 protocol message, and transmits the encapsulated message to the determined virtualized terminal device network element.

5. The method according to any one of claims 1 to 3, characterized in that: Before the access network element parses the received SRv6 protocol message to obtain the tenant identification information, the method further includes: A message forwarding table is stored in the access network element, wherein the index key of the message forwarding table is: the LAN side SID or WAN side SID of the corresponding tenant, and Qinq information, and the value is: a message forwarding mechanism carrying a virtualized terminal device network element identifier; A tenant configuration information table is stored in the virtualized terminal device network element, wherein the index key of the tenant configuration information table is: the LAN side SID, WAN side SID, and Qinq information of the corresponding tenant, and the value is: the tenant configuration information of the corresponding tenant.

6. The method according to any one of claims 1 to 3, characterized in that: The virtualized terminal device network element searches for tenant configuration information matching the tenant identification information according to the tenant identification information, including: The virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information that matches the tenant identification information.

7. The method according to claim 6, characterized in that The virtualized terminal device network element determines an index key according to the tenant identification information, queries a pre-configured tenant configuration information table, and determines tenant configuration information matching the tenant identification information, including: In response to the SRv6 protocol message being a control message, the virtualized terminal device network element uses the tenant identification information as an index key to query a pre-configured tenant configuration information table to determine the tenant configuration information; In response to the SRv6 protocol message being a data message sent by the LAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a WAN side SID according to a pre-stored tenant configuration information table, and uses the converted tenant identification information as an index key to query the tenant configuration information table to determine the tenant configuration information; In response to the SRv6 protocol message being a data message sent from the WAN side, the virtualized terminal device network element converts the SID in the tenant identification information into a LAN side SID according to a pre-stored tenant configuration information table, and uses the tenant identification information obtained after the conversion as an index key to query the tenant configuration information table and determine the tenant configuration information.

8. The method according to any one of claims 1 to 3, characterized in that: The virtualized terminal device network element executes a network service matching the message body with respect to the corresponding tenant identification information according to the found tenant configuration information, including: In response to the SID obtained through the analysis being a LAN side SID, the virtualized terminal device network element performs uplink traffic statistics based on the LAN side SID; In response to the SID obtained through analysis being a WAN-side SID, the virtualized terminal device network element performs downlink traffic statistics based on the WAN-side SID.

9. A tenant isolation service device, characterized in that: The device comprises: A tenant identification information acquisition module, used to parse the received SRv6 protocol message through the access network element to obtain tenant identification information, wherein the tenant identification information includes: SID and Qinq information pre-planned for the tenant, and the SID includes: LAN side SID or WAN side SID; A virtualized terminal device network element determination module, configured to query a pre-configured message forwarding table through the access network element using the tenant identification information as an index key to determine a virtualized terminal device network element that matches the tenant identification information; An information transmission module, configured to transmit the message body corresponding to the SRv6 protocol message and the tenant identification information to the determined virtualized terminal device network element through the access network element; A tenant configuration information search module, used to search for tenant configuration information matching the tenant identification information according to the tenant identification information through the virtualized terminal device network element; The tenant isolation service module is used to execute the network service matching the message body for the corresponding tenant identification information according to the tenant configuration information found through the virtualized terminal device network element.

10. An electronic device comprising a memory, a processor, and a program code stored in the memory and executable on the processor, characterized in that: When the processor executes the program code, the tenant isolation service method described in any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having a program code stored thereon, characterized in that: When the program code is executed by a processor, the steps of the tenant isolation service method described in any one of claims 1 to 8 are implemented.

Images