Edge Cloud Gateway System

Abstract

The disclosed embodiment provides an edge cloud gateway system, which relates to the field of communication technology. The method includes a virtualized switch vSwitch, which is used to receive and forward user traffic through the local area network LAN side and the wide area network WAN side; a virtual customer terminal device VCPE, which is connected to the vSwitch and is used to process the user's business requirements; wherein the user traffic carries identification information, and the vSwitch identifies the user's traffic on the LAN side and the WAN side according to the identification information. The system provided by the disclosed embodiment can pull all user traffic into the edge cloud and implement a virtual machine home gateway through a cloud gateway solution.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to an edge cloud gateway system. Background Art

[0002] At present, new ways of production and life such as online learning, remote conferencing, online shopping, and live video are being promoted at an accelerated pace. Internet platforms are growing stronger and stronger, and individual and home users have gradually moved their data and services to the cloud. However, facing the public cloud service model of the Internet platform, there is still a lack of safe and reliable solutions for services that have high requirements for computing power, latency, storage security and other factors. The connection between home users and the Internet is mainly achieved through traditional optical modems and other devices, and there is still a lack of methods and systems for moving gateway functions to the cloud. Summary of the invention

[0003] The disclosed embodiment provides an edge cloud gateway system, which relates to the field of communication technology, pulls all user traffic into the edge cloud, and implements a virtual machine home gateway through a cloud gateway solution.

[0004] The embodiment of the present disclosure provides an edge cloud gateway system, including: a virtualized switch vSwitch, used to receive and forward user traffic through a local area network (LAN) side and a wide area network (WAN) side; a virtual customer terminal device VCPE, connected to the vSwitch, used to process the user's business requirements; wherein the user traffic carries identification information, and the vSwitch identifies the user's traffic on the LAN side and the WAN side according to the identification information.

[0005] In one embodiment, the VCPE and the vSwitch are connected via a high-speed shared memory virtual interface.

[0006] In one embodiment, the system further includes: an optical network unit ONU, located at the user side, for connecting to the user's terminal equipment; an optical cable terminal OLT, for connecting to the ONU and for forwarding the user's traffic to the vSwitch.

[0007] In one embodiment, the system further includes: a data center switch DCSW, which is used to connect to the OLT and forward the user's traffic to the vSwitch; wherein the user's traffic processed by the OLT includes stacked virtual LAN QINQ information, and the traffic processed by the OLT is encapsulated with a virtual extended LAN VXLAN header after entering the DCSW, and the VXLAN header includes a virtual LAN identity VNI, and the QINQ and the VNI constitute identification information of the user traffic.

[0008] In one embodiment, the DCSW is connected to the vSwitch via a virtual extended local area network VXLAN.

[0009] In one embodiment, the system also includes: an access leaf node A-LEAF, which is used to connect to the OLT and forward the user's traffic to the vSwitch; a service leaf node S-LEAF, which is used to connect to the A-LEAF and forward the user's traffic to the vSwitch; wherein the user's traffic processed by the OLT includes stacked virtual LAN QINQ information, and the traffic processed by the OLT enters the A-LEAF and then encapsulates the segment routing Internet Protocol 6 SRv6 header, and the SRv6 header includes a signaling identifier SID, and the QINQ and the SID constitute the identification information of the user traffic.

[0010] In one embodiment, the A-LEAF is connected to the S-LEAF through the SRv6, and the S-LEAF is connected to the vSwitch through the SRv6.

[0011] In one embodiment, the traffic of the users is isolated from each other according to the identification information when being transmitted.

[0012] In one embodiment, the vSwitch has the capability of performing traffic identification and traffic scheduling on the LAN side, WAN side, VCPE side and edge application side, and has the proxy capability of the Domain Name System DNS on the edge application side.

[0013] In one embodiment, the VCPE has service capabilities of Dynamic Host Configuration Protocol DHCP, Address Resolution Protocol ARP, Point-to-Point Protocol over Ethernet PPPOE and Network Address Translation NAT.

[0014] In one embodiment, the system also includes: a security capability pool for Internet traffic protection, Internet behavior management and user intranet scanning.

[0015] The edge cloud gateway system of the present application includes a virtualized switch vSwitch, which is used to receive and forward user traffic through the local area network LAN side and the wide area network WAN side; a virtual customer terminal device VCPE, which is connected to the vSwitch and is used to process the user's business requirements; wherein the user traffic carries identification information, and the vSwitch identifies the user's traffic on the LAN side and the WAN side according to the identification information, so that all user traffic can be pulled into the edge cloud, and a virtual machine home gateway can be realized through a cloud gateway solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A schematic diagram of the structure of an edge cloud gateway system according to an embodiment of the present disclosure is shown;

[0018] Figure 2 A flow chart of edge cloud traffic forwarding according to an embodiment of the present disclosure is shown;

[0019] Figure 3 The structure diagram of the edge cloud gateway according to one embodiment of the present disclosure is shown;

[0020] Figure 4 A vSwitch traffic scheduling diagram according to an embodiment of the present disclosure is shown;

[0021] Figure 5 A user isolation diagram of a VCPE according to an embodiment of the present disclosure is shown;

[0022] Figure 6 A flowchart of user Internet traffic protection according to an embodiment of the present disclosure is shown;

[0023] Figure 7 A flowchart of user intranet scanning according to an embodiment of the present disclosure is shown;

[0024] Figure 8 A safety protection strategy flow chart of an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0026] In an embodiment of the present disclosure, an edge cloud gateway system is provided, including: a virtualized switch vSwitch, used to receive and forward user traffic through a local area network (LAN) side and a wide area network (WAN) side; a virtual customer terminal device VCPE, connected to the vSwitch, used to process the user's business requirements; wherein the user traffic carries identification information, and the vSwitch identifies the user's traffic on the LAN side and the WAN side according to the identification information, pulls all user traffic into the edge cloud, and implements a virtual machine home gateway through a cloud gateway solution.

[0027] First, some terms of the present disclosure are explained below:

[0028] The Internet (public network) is the Internet in the traditional sense. Everyone's traffic is on the public network without any isolation, such as browsing the web and watching videos.

[0029] Intranet is relative to the public network. It is similar to the private network inside a home or a company, under the export router. For example, a home mobile phone, TV, and computer are all connected through the home router. This network is the intranet. Accessing various websites from the router is the public network.

[0030] In this application, the edge cloud network allocates a dedicated tunnel to the physical intranet above through technologies such as VXLAN (Virtual Extensible Local Area Network) and SRv6 (Segment Routing IPv6, segment routing based on IPv6 forwarding plane), and at the same time, the router is placed on the edge cloud in a virtualized manner. In this way, the original mobile phone is first connected to the router / optical modem, and then connected to the Internet from the WAN port of the router / optical modem. In this way, the user's mobile phone is directly connected to the virtualized router (i.e. VCPE) on the edge cloud through VXLAN or SRv6, through the dedicated tunnel on the metropolitan area network. All user devices are managed through the VCPE of the edge cloud for intranet, and various virtualized apps on the edge cloud are also linked to VCPE.

[0031] Slicing is an on-demand networking method that allows operators to separate multiple virtual end-to-end networks on a unified infrastructure and carry services using SRv6 Policy tunnels with different priorities. Multiple slices can be carried on one link.

[0032] Link is a passive point-to-point physical connection. In wired communication, a link refers to the physical line between two nodes, such as a cable or optical fiber. In radio communication, a link refers to the path space for electromagnetic waves to propagate between a base station and a terminal. A slice can pass through multiple links.

[0033] Tunnel: The tunnel in this application refers to a channel that carries different slices. There can be multiple tunnels carrying different slices in a link.

[0034] Figure 1 A schematic structural diagram of an edge cloud gateway system according to an embodiment of the present disclosure is shown.

[0035] refer to Figure 1 The edge cloud gateway system of the present application includes at least a virtualized switch vSwitch (VirtualisedSwitch), which is used to receive and forward user traffic through a local area network LAN (local area network) side and a wide area network WAN (Wide Area Network) side; a virtual customer terminal device VCPE (virtual Customer Premise Equipment), which is connected to the vSwitch and is used to process the user's business requirements; wherein the user traffic carries identification information, and the vSwitch identifies the user's traffic on the LAN side and the WAN side according to the identification information.

[0036] Figure 1 The connection with the vSwitch belongs to the LAN side, and the WAN side belongs to the connection with the Internet. Figure 1 Not shown in FIG. Figure 1 The access cloud gateway may include one or more vSwitches and one or more VCPEs. Each home user corresponds to an access cloud gateway, which is uniformly controlled and matched by the controller.

[0037] The connection method of the old metropolitan area network:

[0038] Figure 1The home (user) connected to the vSwitch through VXLAN belongs to the connection mode of the old metropolitan area network. In the connection mode of the old metropolitan area network, the edge cloud gateway system also includes an optical network unit ONU (Optical Network Unit), located on the user side, for connecting to the user's terminal device; an optical line terminal OLT (optical line terminal), for connecting to the ONU and for forwarding the user's traffic to the vSwitch. In the old metropolitan area network, the edge cloud gateway system also includes: a data center switch DCSW (Data Center Switches, data center switch), which is used to connect to the OLT and forward the user's traffic to the vSwitch; wherein the user's traffic processed by the OLT includes stacked virtual LAN QINQ (Stacked VLAN or Double VLAN, which means encapsulating the user's private network VLAN Tag in the public network VLAN Tag, so that the message carries two layers of vlantag through the operator's backbone network (public network)) information, and the traffic processed by the OLT enters the DCSW and is encapsulated with a virtual extended LAN VXLAN header. The VXLAN header includes a virtual LAN identity VNI (VXLAN ID to distinguish users), and the QINQ and the VNI constitute the identification information of the user's traffic. Reference Figure 1 , the DCSW is connected to the vSwitch via a virtual extended local area network VXLAN.

[0039] In the old metropolitan area network, the home gateway (such as ONU) accesses the network in VXLAN networking mode. The home gateway can be connected to the OLT device in a bridging manner. After the OLT device processes the home message (traffic), it carries QINQ information. At this time, different home messages will carry different QINQ information; then the home message enters the DCSW device and is encapsulated in the VXLAN header and sent out. At this time, messages from different families may be encapsulated in different VXLAN headers, that is, messages from different families may have different VNIs; the message is sent to the vSwitch of the virtual edge cloud gateway via the LAN side VXLAN network. The VNI+QINQ information carried by different home messages arriving at the edge cloud gateway vSwitch is different, and the VNI+QINQ information corresponds to the home one by one. VNI+QINQ can be called the LAN side message identification information. In the old metropolitan area network, VNI+QINQ information is used as the unique LAN side identifier of the home.

[0040] The message sent from the Internet side to the home intranet can be called the WAN side message. The same WAN side message can also be sent to the vSwitch of the virtual edge cloud gateway through the VXLAN network. At this time, the messages of different families may have different WAN side VNIs. In the old metropolitan area network, the WAN side VNI+QINQ information is also used as the unique WAN side identifier of the family.

[0041] The implementation example of the old metropolitan area network can deploy cloud NAS (Network Attached Storage) services and cloud desktops. Users can directly discover and access the cloud NAS services deployed in the edge cloud through the intranet IP (Internet Protocol) using mobile phones, computers and other terminals at home. The download and upload speed can reach 100MB. The edge cloud desktop service delay is less than 3ms, and users can work, surf the Internet and browse videos smoothly in the cloud desktop.

[0042] The following is an explanation of the vSwitch and VCPE of the old metropolitan area network:

[0043] vSwitch

[0044] vSwitch network element forwarding table entries

[0045] 1. Destination IP forwarding table

[0046] The destination IP of the inner message is used as the key to determine whether the inner message is home edge application traffic.

[0047] 2. VNI_business forwarding table

[0048] 1) Use LAN-side VNI, pvlan_id (private vlan) and cvlan_id (customervlan) as keys;

[0049] 2) value is the index of the forwarding table entry. The core content of the forwarding table includes but is not limited to the following:

[0050] A. Provide VXLAN tunnel interface index for tunnel forwarding for edge application systems;

[0051] B.Edge business switch.

[0052] 3. VNI_forward (direction) forwarding table

[0053] 1) Each home LAN and WAN have two-way bridge forwarding tables;

[0054] 2) VNI (LAN / WAN), pvlan_id and cvlan_id are keys;

[0055] 3) value is the index of the forwarding table entry. The core content of the forwarding table includes but is not limited to the following: the VCPE address that provides network services to the home, using the virtual interface index instead of the VCPE address; the VXLAN tunnel interface index that provides tunnel forwarding for the edge application system.

[0056] 4. VNI_bridge forwarding table

[0057] 1) Each home LAN and WAN have two-way bridge forwarding tables;

[0058] 2) VNI (LAN / WAN), pvlan_id and cvlan_id are keys;

[0059] 3) value is the forwarding table entry index. The core content in the forwarding table includes but is not limited to the following: VXLAN tunnel interface index that provides tunnel forwarding for edge application systems; edge service switch.

[0060] vSwitch network element traffic scheduling

[0061] 1. LAN side traffic scheduling

[0062] 1) Obtain the destination IP of the inner message and determine whether it is home edge application traffic based on the destination IP forwarding table;

[0063] 2) Identify the inner layer message protocol type or port number to determine whether it is edge application traffic;

[0064] 3) According to the VNI_business forwarding table, determine whether the edge application carried by the household traffic is activated;

[0065] 2. WAN-side traffic scheduling

[0066] Traffic is dispatched to the corresponding VCPE for processing according to the VNI_forward forwarding table.

[0067] Edge application traffic scheduling

[0068] According to the VNI_forward forwarding table, the traffic is dispatched to the corresponding VXLAN encapsulation node for processing and forwarding.

[0069] 3. VCPE traffic scheduling

[0070] According to the VNI_forward forwarding table, the traffic is dispatched to the corresponding VXLAN encapsulation node for processing and forwarding.

[0071] DNS Proxy

[0072] Supports home access to edge services through domain names.

[0073] VCPE

[0074] Home configuration isolation

[0075] Relying on the storage unit, the family configuration is stored in two hash table entries based on the uniqueness of the account and the uniqueness of the VNI, pvlan_id and cvlan_id on the family message feature identifier:

[0076] 1) A hash table entry with the family account as the key;

[0077] 2) A bihash (Bounded-index extensiblehash) table entry with VNI, pvlan_id and cvlan_id as the key.

[0078] Both table item storage methods provide a quick search interface.

[0079] VCPE network element traffic scheduling

[0080] According to the type of message, the data message is dispatched by the node to different business processing modules for processing, terminal identification, broadband traffic statistics and Internet access control.

[0081] Business Function Unit

[0082] It includes terminal ARP (Address Resolution Protocol), IPv6 ND (Neighbor Discovery), DHCPv4 / v6 server (Dynamic Host Configuration Protocol, DHCP), DHCPv6-pd (Prefix Delegation), PPPOE (point to point protocal over Ethernet) and NAT (Network Address Traslation) and other functional units. Each business functional unit completes the interactive processing of business messages of different families according to the family isolation hash table items.

[0083] New metropolitan area network connection method:

[0084] Figure 1The households connected to the vSwitch via SRv6 belong to the connection mode of the new metropolitan area network. In the connection mode of the new metropolitan area network, the edge cloud gateway system also includes an access leaf node A-LEAF (access leaf), which is used to connect to the OLT and forward the user's traffic to the vSwitch; a service leaf node S-LEAF (service-Leaf), which is used to connect to the A-LEAF and forward the user's traffic to the vSwitch; wherein the user's traffic processed by the OLT includes stacked virtual LAN QINQ information, and the traffic processed by the OLT enters the A-LEAF and then encapsulates the segment routing Internet Protocol 6 SRv6 header, and the SRv6 header includes a signaling identifier SID, and the QINQ and the SID constitute the identification information of the user traffic. Reference Figure 1 , the A-LEAF is connected to the S-LEAF through the SRv6, and the S-LEAF is connected to the vSwitch through the SRv6.

[0085] In the new metropolitan area network, the home gateway (such as ONU) accesses the network in SRv6 networking mode. The home gateway is connected to the OLT device in a bridging manner. After processing by the OLT device, the home message carries QINQ information. At this time, different home messages will carry different QINQ information; then the home message enters the A-LEAF device and is encapsulated in the SRv6 header and sent out. At this time, messages from different families may be encapsulated in different SRv6 headers, that is, they have different SRH (Segment Routing Header) headers; the message is sent to the virtual edge cloud gateway via the LAN side SRv6 network, and the SID (Signaling Identifier) ​​+ QINQ information carried by different home messages arriving at the edge cloud gateway is different (SRH pops up when arriving at the penultimate segment of the edge cloud gateway. At this time, the message arriving at the edge cloud gateway is an ordinary IPv6 message, and the SID is obtained from the destination IP in the IPv6 header), and the SID + QINQ information corresponds to the home one by one, and SID + QINQ can be called home message identification information. In the embodiment, the SID + QINQ information is used as the unique identifier of the home.

[0086] The message sent from the Internet side to the home intranet is called the WAN side message. The same WAN side message is also sent to the virtual edge cloud gateway through the SRv6 network. At this time, the messages of different households may have different WAN side SIDs. In the embodiment, the WAN side SID+QINQ information is also used as the unique WAN side identifier of the household.

[0087] This instance deploys cloud NAS services and cloud desktops. Users can use mobile phones, computers and other terminals at home to directly discover and access the cloud NAS services deployed on the edge cloud through the intranet IP. The download and upload speed can reach 100MB. The edge cloud desktop service delay is less than 3ms, and users can work, surf the Internet and browse videos smoothly on the cloud desktop.

[0088] The following is an explanation of the vSwitch and VCPE of the new metropolitan area network:

[0089] vSwitch

[0090] vSwitch network element forwarding table entries

[0091] 1. Destination IP forwarding table

[0092] The destination IP address of the inner message is used as the key to determine whether the inner message is home edge application traffic.

[0093] 2. SID_business service forwarding table

[0094] 1) Use LAN side SID, pvlan_id and cvlan_id as key;

[0095] 2) value is the index of the forwarding table entry. The core content of the forwarding table includes but is not limited to the following:

[0096] A. Provide VXLAN tunnel interface index for tunnel forwarding for edge application systems;

[0097] B.Edge business switch.

[0098] 3. SID_forward forwarding table

[0099] 1) Each home LAN and WAN have two-way bridge forwarding tables;

[0100] 2) SID (LAN / WAN), pvlan_id and cvlan_id are keys;

[0101] 3) value is the index of the forwarding table entry. The core content in the forwarding table includes but is not limited to the following: the VCPE address that provides network services to the home. In this embodiment, the virtual interface index is used instead of the VCPE address; the VXLAN tunnel interface index that provides tunnel forwarding for the edge application system.

[0102] vSwitch network element traffic scheduling

[0103] 1. LAN side traffic scheduling

[0104] 1) Obtain the destination IP of the inner message and determine whether it is home edge application traffic based on the destination IP forwarding table;

[0105] 2) Identify the inner layer message protocol type or port number to determine whether it is edge application traffic;

[0106] 3) According to the SID_business forwarding table, determine whether the edge application carried by the household traffic is activated;

[0107] 2. WAN-side traffic scheduling

[0108] Traffic is dispatched to the corresponding VCPE for processing according to the SID_forward forwarding table.

[0109] 3. Edge application traffic scheduling

[0110] According to the SID_forward forwarding table, the traffic is dispatched to the corresponding SRv6 encapsulation node for processing and forwarding.

[0111] 4. VCPE traffic scheduling

[0112] According to the SID_forward forwarding table, the traffic is dispatched to the corresponding SRv6 encapsulation node for processing and forwarding.

[0113] DNS Proxy

[0114] Supports home access to edge services through domain names.

[0115] VCPE

[0116] Home configuration isolation

[0117] Relying on the storage unit, the family configuration is saved in two hash table entries according to the uniqueness of the account and the uniqueness of the SID, pvlan_id and cvlan_id on the family message feature identifier.

[0118] 1) A hash table entry with the family account as the key;

[0119] 2) A bihash entry with SID, pvlan_id and cvlan_id as key.

[0120] Both table item storage methods provide a quick search interface.

[0121] VCPE network element traffic scheduling

[0122] According to the type of message, the data message is dispatched by the node to different business processing modules for processing, terminal identification, broadband traffic statistics and Internet access control.

[0123] Business Function Unit

[0124] The service function units include terminal arp, IPv6 ND, DHCPv4 / v6 server, DHCPv6-pd, PPPOE and NAT function units. Each service function unit completes the interactive processing of service messages of different families according to the family isolation hash table items.

[0125] In the edge cloud gateway system of this application, all user traffic goes to the edge cloud side, and virtualized gateway services are used in the edge cloud to achieve traffic diversion and management, without the need to purchase dedicated equipment at home for network access. Through the large bandwidth and low latency advantages of the metropolitan area network, the user experience of cloud desktops and cloud NAS can be made consistent with that of physical devices. At the same time, through the elastic expansion and contraction and resource sharing of the cloud, storage, computing power and other resources can be flexibly arranged between applications.

[0126] The following is an overall description of the solution of this application:

[0127] The technical solution of this application can be summarized as including three parts: user network access process, network virtual switching system, and edge intranet security protection strategy, specifically:

[0128] (I) User network access process

[0129] The layer 2 network access edge process of this application is to introduce all traffic to the edge DC (DATACENTER) from the user terminal side. There is no need to carry the user name and password to initiate dial-up according to the original broadband Internet access process. Instead, a separate slice or tunnel is allocated to each user through VLAN or SRv6, and the user data packet is sent directly to the edge cloud, and the edge cloud gateway identifies and diverts the traffic. Internal traffic (including within the user's home and within the edge application) is mounted on the LAN port, and layer 2 or layer 3 network communication is achieved through the address allocated by VCPE. External traffic is diverted to the Internet after PPPOE dial-up is completed at the edge through the WAN port to complete Internet access.

[0130] The process can be connected through direct connection or home gateway bridging. Under different metropolitan area network structures, the intranet can be connected by combining and configuring VLAN, VxLAN or SRv6 technologies as needed to complete the connection of the Layer 2 network.

[0131] The process is generally connected through a two-layer connection, and can also be connected using a three-layer connection depending on the network equipment or architecture, mainly to meet the needs of accessing users' home terminals, applications, and edge-side applications through the same set of intranet addresses.

[0132] The process can separate different traffic of the same user and establish multiple tunnels to the edge cloud network according to business needs (such as IPTV, Internet TV).

[0133] (ii) Network virtual switching system,

[0134] The network virtual switching system of the present application provides a method for cloud-based bearer LAN gateway. The home gateway (such as ONU) is connected to the OLT device in a bridging manner. At this time, different user messages carry different QINQ information, and then are sent to the virtual edge cloud gateway via the LAN side network. Depending on the different networking methods of extending the intranet to the edge cloud gateway, different user messages will carry different VXLAN information or SRv6 information; the network virtual switching system includes: access vSwitch network elements and VCPE network elements. The access vSwitch network element and the VCPE network element are connected through a high-speed virtual interface implemented by shared memory. The access vSwitch network element is a traffic access point, providing the ability of VXLAN and SRv6 access to the edge cloud gateway, providing the destination IP, message protocol and port number forwarding capability based on the inner layer message of the tunnel, and providing the user traffic scheduling capability based on VNI+QINQ or SID+QINQ; the VCPE network element provides soft gateway services for isolating users in the home intranet, including terminal arp, IPv6ND, DHCPv4 / v6 server, DHCPv6-pd, PPPOE and NAT functions.

[0135] The access vSwitch network element and the VCPE network element both include a data I / O (Input / Output) unit, a data forwarding unit, a data storage unit and a signaling unit, wherein the VCPE network element also includes a service processing unit; the data I / O unit is responsible for receiving and sending data; the data forwarding unit is connected to the data I / O unit; the service processing unit is connected to the data forwarding unit; the data storage unit is connected to the signaling unit; the service processing unit and the data forwarding unit can access or write to the data storage unit.

[0136] The signaling unit provides an external interface and a visual command line for managing the data storage unit according to the control signaling;

[0137] The data storage unit is used in the access network element to store the network element configuration information issued by the signaling unit and the forwarding table items used by the data forwarding unit; in addition to storing the network element configuration information, the VCPE network element is also used to isolate and store the data set of the multi-user account table items, and provide a quick query interface for the service processing unit to distinguish multiple users;

[0138] The data forwarding unit is used for scheduling and processing of multi-user data streams in the access network element, and dispatches the messages to different VCPE network elements for processing according to different message protocol types or user message identification information; the VCPE network element is used for scheduling and processing of multi-user data streams, and dispatches the messages to corresponding service processing units according to different message protocol types;

[0139] The service processing unit includes terminal arp, IPv6 ND, DHCPv4 / v6 server, DHCPv6-pdclient, PPPOE client and NAT service units;

[0140] The terminal ARP service processing unit is used for ARP service processing when the user terminal accesses the cloud gateway;

[0141] The IPv6 ND service processing unit is used for NS / NA (Network Service) and RS / RA (Router Solicitation) service processing between the VCPE network element and the LAN / WAN side;

[0142] The DHCPv4 server service processing unit is used for service processing such as IP address allocation and user terminal management of user terminals;

[0143] The DHCPv6 server service processing unit is only used for IPv6 DNS (Domain Name System) service processing of the user terminal;

[0144] The DHCPv6-pd client service processing unit is used to apply for IPv6 prefix service processing for the user;

[0145] The PPPOE client service processing unit is used for processing the user's Internet access dial-up service;

[0146] The NAT service processing unit is used for IP address conversion service processing of user broadband traffic.

[0147] The data I / O unit is used for sending and receiving multi-user data streams.

[0148] The present application also provides a solution, wherein the data I / O unit, in the access network element, adopts DPDK (DPDK, Data Plane Development Kit) to manage the physical interface, and adopts a shared memory high-speed forwarding virtual port to connect with the VCPE network element; in the VCPE network element, a shared memory high-speed forwarding virtual port is adopted to connect with the access network element.

[0149] The present application also provides a solution, whereby the data I / O unit between the access network element and the VCPE network element can flexibly expand the private message space to facilitate the transmission of user message identification information.

[0150] The present application also provides a solution, wherein the data storage unit is used to isolate and save user account rule management and provide a quick query interface for the data processing unit or the business processing unit, while providing isolated and saved information on the online and offline status of the user's downstream terminal and message statistics.

[0151] The present application also provides a solution, wherein the data forwarding unit is used to perform message processing through vectorized message processing technology to perform traffic forwarding processing within the virtual network element.

[0152] The present application also provides a solution, wherein the service processing unit includes functional units such as terminal arp, IPv6 ND, DHCPv4 / v6server, DHCPv6-pd, PPPOE and NAT.

[0153] The present application also provides a solution, wherein the ARP service module performs ARP learning on the user terminal through a PPPoE interface that uniquely identifies the activation of the user's broadband service.

[0154] The traffic scheduling node is used for user data message identification, message scheduling, terminal identification, Internet access control and message statistics based on user terminals;

[0155] The arp service module performs user terminal arp learning through the pppoe interface and uses the lan side gateway mac address to send an arp response message to the user.

[0156] The IPv6 ND, DHCPv6-pd (Prefix Delegation) and PPPOE service modules interact with the BRAS by using the mac (Media Access Control) address of the wan-side gateway.

[0157] The present application also provides a solution, wherein the access network element provides a DNS proxy function;

[0158] The present application also provides a solution, wherein the access network element has traffic scheduling capabilities based on the destination IP, message protocol, port number and VNI+QINQ or SID+QINQ forwarding table, including tunnel bridging, virtual port and tunnel forwarding capabilities;

[0159] The present application also provides a solution, wherein the access network element is connected to the edge application system based on the forwarding scheduling capability.

[0160] Figure 2 A flow chart of edge cloud traffic forwarding according to an embodiment of the present disclosure is shown.

[0161] refer to Figure 2, ONU traffic carries cvlan tags; OLT adds pvlan tags; A-LEAF queries the vpn (virtual private network) instance according to the interface rule pVLAN, encapsulates SRv6 and forwards it; vSwitch: extracts the Qinq+IPv6-SA (Source Address) field in the message, looks up the table to obtain VCPE, and forwards it to VCPE; 2) VCPE: adds a PPPOE header in the OLT direction, removes the PPPOE header in the BRAS (Broadband Remote Access Server), writes to vSwitch for forwarding; 3) vSwitch: queries SRv6 encapsulation information according to the QINQ+ direction, encapsulates and forwards it; VCPE has 1) DHCP protocol processing; 2) ARP protocol processing; 3) PPPOE protocol processing; 4) OLT->BRAS process forwarding 5) BRAS->OLT traffic forwarding; S-LEAF (BRAS) forwards to the Internet.

[0162] Figure 3 A structural diagram of an edge cloud gateway according to an embodiment of the present disclosure is shown.

[0163] refer to Figure 3 The vSwitch has the ability to identify and schedule traffic on the LAN side, WAN side, VCPE side and edge application side, and has the proxy capability of the domain name system DNS on the edge application side. Among them, VXLAN-3 corresponds to the WAN side, and the rest correspond to the LAN side. Among them, VMBA is the functional module of the proxy service.

[0164] Figure 4 A vSwitch traffic scheduling diagram according to an embodiment of the present disclosure is shown.

[0165] Figure 5 A user isolation diagram of a VCPE according to an embodiment of the present disclosure is shown. Figure 5 The tenants can be households, and the services provided by VCPE are described in detail.

[0166] 3.3 Edge Intranet Security Protection Strategy

[0167] The edge cloud gateway system of the present application also includes: a security capability pool for Internet traffic protection, Internet behavior management and user intranet scanning.

[0168] The edge intranet security protection strategy described in this application is mainly aimed at the scenario where the edge intranet is connected. From the perspectives of user safe Internet access, home intranet protection, home Internet access management, and security analysis reports, security protection solutions for three scenarios are proposed, namely Internet traffic protection, Internet behavior management, and home intranet scanning solutions.

[0169] In the Internet traffic protection solution, after the user issues a traffic detection strategy through the product portal, the security control center cooperates with the cloud bandwidth management platform to issue a traffic mirroring strategy with the user's broadband account to the security service gateway. The security service gateway is responsible for mirroring the designated broadband Internet traffic to the edge cloud security capability pool. The Internet traffic detection component in the security capability pool performs traffic detection and analysis, reports the results to the security control center, and presents them to the user through the product portal. The security control center generates a blocking strategy based on the detection results and user configuration, and sends it to the security service gateway through the cloud bandwidth platform. After receiving the blocking strategy, the security service gateway matches the traffic and blocks the corresponding traffic. Other traffic is returned to the access gateway, which is then forwarded to the Internet side. The blocking log is reported to the security control center and presented to the user through the product portal. The entire protection solution can provide users with functions such as malicious URL access identification, fraudulent website identification, and virus detection to protect user Internet security. Figure 6 A flowchart of user Internet traffic protection according to an embodiment of the present disclosure is shown. Figure 6 In , SPINE is a spine network.

[0170] The process of the Internet behavior management solution is similar to the Internet traffic protection solution. The difference lies in the security atomic capability of the edge cloud security capability pool. In this solution process, the security capability pool provides users with on-demand management and filtering of visited websites, APPs, etc., Internet access time control (time-sharing Internet disconnection, one-click Internet disconnection), Internet behavior analysis (Internet access time analysis, APP usage preference analysis) and other capabilities.

[0171] In the home intranet scanning solution, users order and issue scanning tasks through APP, portals, etc. After receiving the task, the security control center obtains user asset information from the cloud broadband management platform, forms a scanning strategy and sends it to the security capability pool. The edge security capability pool vulnerability scanning module establishes a tunnel with the home intranet, sends scanning messages to the target device in the intranet, and performs vulnerability analysis based on the terminal's response message. The home intranet scanning module reports the leaked scanning results to the security control center, which is presented or reminded through the product portal.

[0172] Figure 7 A flowchart of user intranet scanning according to an embodiment of the present disclosure is shown.

[0173] Figure 8 A safety protection strategy flow chart of an embodiment of the present disclosure is shown.

[0174] The term "comprising" and any variations thereof in the specification, claims and drawings of the embodiments of the present disclosure are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment comprising a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other steps and units inherent to these processes, methods, devices, products or equipment.

[0175] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in this description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0176] The method and related apparatus provided by the embodiments of the present disclosure are described with reference to the method flow chart and / or structural diagram provided by the embodiments of the present disclosure. Specifically, each process and / or block in the method flow chart and / or structural diagram, as well as the combination of the processes and / or blocks in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable transmission device to generate a machine, so that the instructions executed by the processor of the computer or other programmable transmission device generate instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or structures Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable transmission device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or structures Figure 1 These computer program instructions can also be loaded onto a computer or other programmable transmission device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A flow or multiple flows and / or structures illustrate the steps of the functions specified in one block or multiple blocks.

[0177] The above disclosure is only a preferred embodiment of the present disclosure, which certainly cannot be used to limit the scope of rights of the present disclosure. Therefore, equivalent changes made according to the claims of the present disclosure are still within the scope of the present disclosure.

Claims

1. An edge cloud gateway system, characterized in that: include: A virtualized switch vSwitch, used to receive and forward user traffic through a local area network (LAN) side and a wide area network (WAN) side; wherein the user traffic carries identification information, and the vSwitch identifies the user traffic on the LAN side and the WAN side according to the identification information; A virtual customer terminal equipment VCPE, connected to the vSwitch, for processing the service requirements of the user; An optical network unit ONU, located at the user side, and used to connect to the user's terminal equipment; An optical cable terminal OLT, used to connect to the ONU and to forward the user's traffic to the vSwitch; An access leaf node A-LEAF, which is used to connect to the OLT and to forward the user's traffic to the vSwitch; A service leaf node S-LEAF, which is used to connect to the A-LEAF and forward the user's traffic to the vSwitch; Among them, the user's traffic after being processed by the OLT includes stacked virtual LAN QINQ information, and the traffic processed by the OLT enters the A-LEAF and then encapsulates the segment routing Internet Protocol 6 SRv6 header, the SRv6 header includes a signaling identifier SID, and the QINQ and the SID constitute the identification information of the user's traffic.

2. The system according to claim 1, characterized in that The VCPE and the vSwitch are connected via a high-speed shared memory virtual interface.

3. The system according to claim 1, characterized in that Also includes: A data center switch DCSW, used to connect to the OLT and to forward the user's traffic to the vSwitch; Among them, the user's traffic after being processed by the OLT includes stacked virtual LAN QINQ information. After the traffic processed by the OLT enters the DCSW, it is encapsulated with a virtual extended LAN VXLAN header. The VXLAN header includes a virtual LAN identity VNI. The QINQ and the VNI constitute the identification information of the user's traffic.

4. The system according to claim 3, characterized in that The DCSW is connected to the vSwitch via a virtual extended local area network VXLAN.

5. The system according to claim 1, characterized in that The forwarding table entries of the vSwitch network element include: The destination IP forwarding table is used to determine whether the inner message is home edge application traffic by using the destination IP of the inner message as the key; SID_business service forwarding table, which uses LAN-side SID, pvlan_id and cvlan_id as keys; value is the forwarding table entry index; SID_forward forwarding table, a bridge forwarding table for each home LAN and WAN, with SID, pvlan_id and cvlan_id as keys; value is the index of the forwarding table entry. The core content of the forwarding table includes: the VCPE address that provides network services for the home, and the VXLAN tunnel interface index that provides tunnel forwarding for the edge application system.

6. The system according to claim 5, characterized in that The A-LEAF is connected to the S-LEAF through the SRv6, and the S-LEAF is connected to the vSwitch through the SRv6.

7. The system according to claim 1, characterized in that The traffic of the users is isolated from each other according to the identification information when being transmitted.

8. The system according to claim 1, characterized in that The vSwitch has the capability of performing traffic identification and traffic scheduling on the LAN side, WAN side, VCPE side and edge application side, and has the proxy capability of the domain name system DNS on the edge application side.

9. The system according to claim 1, characterized in that The VCPE has the service capabilities of Dynamic Host Configuration Protocol DHCP, Address Resolution Protocol ARP, Ethernet Point-to-Point Connection Protocol PPPOE and Network Address Translation NAT.

Images