Method and device for secure transmission of ipv6 traffic in a cloud network

Abstract

The application discloses a method and device for secure transmission of IPv6 traffic in a cloud network, comprising the following steps: first, a virtual switch acquires first service traffic messages sent by a virtual machine; then, the virtual switch transforms the first service traffic messages, adds an identification tag to the first service traffic messages, generates second service traffic messages, and sends the second service traffic messages to a tenant gateway; finally, the tenant gateway executes corresponding security conversion strategies on the second service traffic messages according to the identification tag, generates reply messages, and interacts with an external network gateway according to the reply messages. In the application, the processing flow of the reserved field of the traffic type field of the IPv6 message is improved and utilized, the IPv6 traffic tagging process is defined, the security conversion address, the security conversion table item and the processing process of security conversion through the tenant gateway are defined, the cloud network data center IPv6 traffic security is realized, and the data security is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of resource scheduling, and particularly relates to a secure transmission method and device for IPv6 traffic in a cloud network. BACKGROUND

[0002] As a basic technical protocol of next-generation network, IPv6 has a larger address space, uses a smaller routing table, and has a faster router forwarding packet speed. The cloud data center IPv6 public network exit mode includes routing exit and NDrpoxy exit. Since there are too many IPv6 network segments, too many backhaul routes need to be configured on the exit gateway device, and most cloud operators choose the IPv6 NDproxy mode for exit. If the neighbor request is sent from a host in one network to another host in the same network segment but not in the same physical network, the device with proxy function connecting them can answer the request and respond to the neighbor advertisement message. This process is called ND proxy (ND Proxy). The ND Proxy function hides the fact that the physical networks are separated, making it seem to users that they are on the same physical network.

[0003] In the prior art, in the communication process using IPv6 NDproxy, the servers in the data center are more vulnerable to attacks, the IPv6 addresses in the data center are more easily located, and the IPv6 exit traffic cannot be defined based on traffic type. SUMMARY

[0004] The present application proposes a secure transmission method and device for IPv6 traffic in a cloud network to solve the existing problems, and the specific technical solutions are as follows:

[0005] In the first aspect of the present application, a secure transmission method for IPv6 traffic in a cloud network is provided, and the method includes:

[0006] The virtual switch obtains the first service traffic message sent by the virtual machine;

[0007] The virtual switch modifies the first service traffic message, adds an identification tag to the first service traffic message, generates a second service traffic message, and sends the second service traffic message to the tenant gateway;

[0008] The tenant gateway executes a corresponding security conversion strategy on the second service traffic message according to the identification tag to generate a reply message;

[0009] The tenant gateway performs service traffic data interaction with the external gateway according to the reply message.

[0010] Optionally, the step of modifying the first service traffic packet to add an identification tag to the first service traffic packet to generate a second service traffic packet comprises:

[0011] analyzing the first service traffic packet to determine a packet header of the first service traffic packet;

[0012] modifying a source IP address of the packet header using a preset process, adding an identification tag, and performing an extensible virtual local area network encapsulation to generate a second service traffic packet.

[0013] Optionally, the step of modifying the source IP address of the packet header using the preset process and adding the identification tag comprises:

[0014] locating a traffic data segment of the packet header using the preset process;

[0015] adding a security transfer tag to a reserved field of the traffic data segment.

[0016] Optionally, the step of sending the second service traffic packet to the tenant gateway comprises:

[0017] establishing an extensible virtual local area network tunnel between the virtual switch and the tenant gateway, and sending the second service traffic packet to the tenant gateway through the extensible virtual local area network tunnel.

[0018] Optionally, the step of the tenant gateway executing a corresponding security conversion strategy on the second service traffic packet according to the identification tag to generate a reply packet comprises:

[0019] analyzing the second service traffic packet to obtain a source IP address and a security transfer tag of the second service traffic packet;

[0020] executing different second service traffic packet processing strategies according to a matching condition of the source IP address and a screening strategy;

[0021] in a case where the source IP address matches the screening strategy, converting the source IP address into a security address in a security address pool according to the security transfer tag;

[0022] configuring a security traffic path according to the security address and generating the reply packet.

[0023] Optionally, the security address pool is obtained by the following steps:

[0024] reserving a subnet segment as a security address pool in a planning stage of an external network gateway address, wherein the security address pool converts the source IP address into the security address using a random encryption algorithm.

[0025] Optionally, the step of configuring the secure traffic path according to the secure address comprises:

[0026] inputting the secure address and configuration parameters into a security translation entry template to generate a secure traffic path configuration file, wherein the configuration parameters comprise a translation type, a protocol number, a destination address, and an aging time.

[0027] Optionally, the step of interacting with the external network gateway according to the reply message comprises:

[0028] sending the reply message to the external network gateway;

[0029] analyzing the neighbor request by the external network gateway and generating a feedback message;

[0030] requesting a hardware address of the tenant gateway and sending the feedback message to the tenant gateway according to the hardware address;

[0031] forwarding the feedback message to the virtual machine by the tenant gateway.

[0032] In a second aspect of the present application, a device for secure transmission of IPv6 traffic in a cloud network is provided, and the device comprises:

[0033] a first sending module configured to acquire a first service traffic message sent by a virtual machine by a virtual switch;

[0034] a second sending module configured to modify the first service traffic message by the virtual switch, add an identification tag to the first service traffic message to generate a second service traffic message, and send the second service traffic message to a tenant gateway;

[0035] a request message generating module configured to execute a corresponding security translation strategy on the second service traffic message by the tenant gateway according to the identification tag to generate a reply message;

[0036] an interaction module configured to interact with an external network gateway by the tenant gateway according to the reply message.

[0037] Optionally, the second sending module comprises:

[0038] an analysis submodule configured to analyze the first service traffic message to determine a message header of the first service traffic message;

[0039] an identification submodule configured to modify a source IP address of the message header by a preset process, add an identification tag, and perform extensible virtual local area network encapsulation to generate a second service traffic message.

[0040] Optionally, the second transmitting module further includes:

[0041] The header determination submodule is used to parse the first service traffic packet and determine the header of the first service traffic packet;

[0042] The identification tag adding submodule is used to modify the source IP address of the packet header using a preset process, add identification tags, and perform scalable virtual LAN encapsulation to generate a second service traffic packet.

[0043] Optionally, the identification label adding submodule includes:

[0044] A positioning unit is used to locate the traffic data segment of the packet header using a preset process;

[0045] A tag adding unit is used to add a secure transfer tag to the reserved field of the traffic data segment.

[0046] Optionally, the second transmitting module further includes:

[0047] The message sending module is used to establish a scalable virtual local area network tunnel between the virtual switch and the tenant gateway, and to send the second service traffic message to the tenant gateway through the scalable virtual local area network tunnel.

[0048] Optionally, the request message generation module includes:

[0049] The second service traffic packet parsing submodule is used to parse the second service traffic packet to obtain the source IP address and security transfer tag of the second service traffic packet;

[0050] The execution submodule is used to execute different second service traffic packet processing strategies based on the matching of the source IP address and the filtering strategy;

[0051] The secure address generation submodule is used to convert the source IP address into a secure address in the secure address pool based on the secure transfer tag, when the source IP address matches the filtering policy.

[0052] The configuration submodule is used to configure the secure traffic path based on the secure address and generate the reply message.

[0053] Optionally, configuration submodules include:

[0054] Input the secure address and configuration parameters into the secure translation table template to generate a secure traffic path configuration file. The configuration parameters include: translation type, protocol number, destination address, and aging time.

[0055] Optionally, the interaction module comprises:

[0056] The reply message sending submodule is configured to send the reply message to the external network gateway.

[0057] The feedback message generating submodule is configured to parse the neighbor request by the external network gateway and generate a feedback message.

[0058] The feedback message sending submodule is configured to request the hardware address of the tenant gateway and send the feedback message to the tenant gateway according to the hardware address.

[0059] The feedback message forwarding submodule is configured to forward the feedback message to the virtual machine by the tenant gateway.

[0060] In a third aspect of the present application, an electronic device is provided, which comprises a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the method of the first aspect.

[0061] In a fourth aspect of the present application, a computer readable storage medium is provided, which stores a computer program, and the processor executes the computer program to implement the method of the first aspect.

[0062] The present application has the following beneficial effects: in the embodiments of the present application, first, the virtual switch obtains the first service traffic message sent by the virtual machine, then the virtual switch modifies the first service traffic message, adds an identification tag to the first service traffic message, generates a second service traffic message, and sends the second service traffic message to the tenant gateway. Finally, the tenant gateway executes a corresponding security conversion policy on the second service traffic message according to the identification tag, generates a reply message, and performs service traffic data interaction with the external network gateway according to the reply message. In the present application, the processing flow of the reserved field of the traffic type field of the IPv6 message is improved and utilized, the IPv6 traffic tagging process is defined, the security conversion address, the security conversion table item, and the processing process of security conversion through the tenant gateway are defined, the cloud network data center IPv6 traffic security is realized, and the security of the data is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0063] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure together with the specification.

[0064] Figure 1 Fig. 1 is a schematic diagram of an NDproxy networking architecture in an existing cloud network;

[0065] Figure 2An electronic device structure schematic diagram of a hardware running environment involved in an embodiment of the present application;

[0066] Figure 3 A flow chart of a secure transmission method of IPv6 traffic in a cloud network according to an exemplary embodiment;

[0067] Figure 4 A structure schematic diagram of an original IPv6 header and a traffic type field according to an exemplary embodiment;

[0068] Figure 5 A structure of a traffic type field in a modified IPv6 header according to an exemplary embodiment;

[0069] Figure 6 A code table diagram of a security conversion label according to an exemplary embodiment;

[0070] Figure 7 A flow chart of a labeling processing of an IPv6 message by a virtual switch according to an exemplary embodiment;

[0071] Figure 8 A flow chart of a processing of a received message by a tenant gateway according to an exemplary embodiment;

[0072] Figure 9 A security conversion table item template schematic diagram according to an exemplary embodiment;

[0073] Figure 10 A process schematic diagram of IPv6 traffic security egress of a virtual machine according to an exemplary embodiment;

[0074] Figure 11 A block diagram of a secure transmission device of IPv6 traffic in a cloud network according to an exemplary embodiment. DETAILED DESCRIPTION

[0075] In order to make the above objectives, features and advantages of the present application more apparent, further specific embodiments of the present application will be described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0076] In the related art, the network virtualization technology of most cloud vendors is VXLAN (Virtual Extensible Local Area Network) technology. The cloud platform combines the architecture of SDN (Software Defined Network) to make network virtualization more convenient and convenient. The network is sliced, and the entire architecture is as follows Figure 1Network virtualization enables two tenants to use the same network address completely and isolate data traffic, and neither tenant nor application can perceive or capture the traffic inside the other virtual network.

[0077] The communication process based on the IPv6 NDproxy includes that the NDproxy function is started on a tenant gateway, and an IPV6 network segment of a VM belongs to a network segment of an external gateway. Traffic goes out of the external network, the IPv6 traffic of the VM reaches the tenant gateway after being encapsulated by the VXLAN, the tenant gateway forwards the packet to the external gateway through the IPv6 default route after being decapsulated, and then the packet is normally transmitted out of the external network; external network backhaul traffic, after the backhaul response traffic reaches the external gateway, the external gateway discovers that the destination IP is in the same network segment NS and requests the MAC address of the destination IP. The tenant gateway starts the NDproxy, and the NA answers the MAC address of the tenant gateway to the external gateway, so that the traffic is successfully forwarded to the tenant gateway, the tenant gateway checks the host table and sends to the destination VM, and the whole communication process is completed.

[0078] However, the IPv6 address of the VM in the data center is exposed in the public network through the IPv6 transmission packet, which is easy to be discovered by packet capture, and network hackers can perform malicious attacks on the IPv6 address. Common network attacks such as DDOS, CC, ND spoofing, and virus attacks are all attacks caused by IP address exposure. In addition, the IP address can directly reflect the city where it is located, and through certain technical reconnaissance, more detailed address can be obtained, and then the geographical location of the server is exposed. The traditional network security solution traffic security can only be based on the whole network, and cannot realize the customized security solution according to the traffic type of a virtual machine. That is, different security outbound definitions and protections cannot be realized for the subdivided TCP and UDP traffic.

[0079] To solve the above problems, the specific idea provided by the embodiment of the application is that: by modifying and applying the last two bits of the traffic type field in the IPv6 header, a label field is defined, the NDproxy communication process is optimized, and a security public network solution based on the IPv6 traffic type granularity of the virtual machine is realized. The virtual machine traffic is marked with different labels according to the traffic type and source address conversion strategy, the source address is converted on the tenant gateway, the address of the server in the data center is protected, and the address of the server in the public network is avoided.

[0080] Reference Figure 2 , Figure 2 The electronic device structure schematic diagram of the hardware running environment related to the embodiment of the application is shown in FIG. 1.

[0081] As Figure 2As shown, the electronic device can include: a processor 2001, for example, a central processing unit (CPU), a communication bus 2002, a user interface 2003, a network interface 2004, a memory 2005. Among them, the communication bus 2002 is used to realize the connection communication between these components. The user interface 2003 can include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 2003 can also include a standard wired interface, a wireless interface. The network interface 2004 can optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 2005 can be a high-speed random access memory (RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, N virtual machine), such as a disk memory. The memory 2005 can also be an optional storage device independent of the aforementioned processor 2001.

[0082] Those skilled in the art can understand that Figure 2 The structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0083] As Figure 2 As shown, the memory 2005 as a storage medium can include an operating device, a data storage module, a network communication module, a user interface module, and an electronic program.

[0084] In Figure 2 As shown in the electronic device, the network interface 2004 is mainly used for data communication with the network server; the user interface 2003 is mainly used for data interaction with the user; the processor 2001 and the memory 2005 in the electronic device of the application can be arranged in the electronic device, and the electronic device calls the security transmission device of IPv6 traffic in the cloud network stored in the memory 2005 through the processor 2001, and executes the security transmission method of IPv6 traffic in the cloud network provided by the application.

[0085] Referring to Figure 3 , based on the foregoing hardware running environment, the embodiment of the application provides a security transmission method of IPv6 traffic in a cloud network, comprising the following steps:

[0086] S301: The virtual switch obtains the first service traffic message sent by the virtual machine.

[0087] In the embodiment, the whole scheme marks the IPv6 traffic sent by the virtual machine, first, the original IPv6 packet sent by the virtual machine (first service traffic packet) arrives at the virtual switch.

[0088] S302: The virtual switch transforms the first service traffic packet, adds an identification tag to the first service traffic packet, generates a second service traffic packet, and sends the second service traffic packet to the tenant gateway.

[0089] In the embodiment, after the virtual switch receives the first service traffic packet, it needs to solve the problem of identification tag definition and the problem of where and how to put the identification tag, and the specific implementation steps include:

[0090] S302-1: Analyzing the first service traffic packet to determine the packet header of the first service traffic packet;

[0091] S302-2: Using a preset process to modify the source IP address of the packet header, adding an identification tag, and performing extensible virtual local area network encapsulation to generate a second service traffic packet.

[0092] S302-2-1: Using a preset process to locate the traffic data segment of the packet header.

[0093] S302-2-2: Adding a security transfer tag to the reserved field of the traffic data segment.

[0094] S302-3: The virtual switch and the tenant gateway establish an extensible virtual local area network tunnel, and send the second service traffic packet to the tenant gateway through the extensible virtual local area network tunnel.

[0095] In the embodiment of S302-1 to S302-3, first, for the problem of tag definition, in the structure of the original IPv6 header, as shown in the attached Figure 4 , the traffic type field occupies a total of 1 byte, for the definition of the service type field, the first 6 bit positions are defined as DSCP, which is used for traffic marking and quality of service business. The last 2 bit positions are CU reserved fields (CU, current unused). In this application, the traffic type field is transformed, mainly the last 2 bits which are not defined are defined as Security Transfer Label, i.e. security transfer tag, and the transformed one is as shown in the attached Figure 5As shown in the figure. In this way, the security transfer label in the IPv6 header identifies different IPv6 traffic and source address conversion policies. As long as the traffic type field in the IPv6 header is analyzed, it can be determined whether the IPv6 message needs to be converted for security, and the source address is differentiated. The security transfer label l has only 2 bits, which can realize 4 kinds of differentiated security conversion policy making. The code table of the security conversion label is defined as Figure 6 As shown in the figure, STL = 00 represents that the IPv6 traffic sent by the virtual machine is normally forwarded without any security conversion. STL = 01 represents that all IPv6 traffic sent by the virtual machine is subjected to security address conversion, and the source address is converted to a security address. STL = 10 represents that the IPv6 traffic and the four-layer protocol number TCP sent by the virtual machine are subjected to security address conversion, and the source address is converted to a security address. STL = 11 represents that the IPv6 traffic and the four-layer protocol number UDP sent by the virtual machine are subjected to security address conversion, and the source address is converted to a security address.

[0096] As for the problem of where and how to mark the identification label, the marking process of the entire scheme for the IPv6 traffic sent by the virtual machine. The control layer hopes to customize the security conversion of the IPv6 traffic of the virtual machine, and the controller issues a flow table to the virtual switch through Openflow and issues a configuration to the tenant gateway through Netconf. The virtual switch and the tenant gateway establish a virtual local area network tunnel. The marking process of the IPv6 message of the virtual switch is as shown in the figure. Figure 7 As shown in the figure, first, the traffic of the virtual machine is matched with the next hop of the security policy flow table of the virtual switch before tunnel encapsulation, and then it is judged whether the next hop interface is an extensible virtual local area network interface. If it is an extensible virtual local area network interface, the Openvswitch.ko process of the virtual switch marks the message with a security label, modifies the source IP of the encapsulated message, and marks the last two bits of the traffic type of the source IP with a security transfer label, thereby generating a second service traffic message. Then the second service traffic message is encapsulated with an extensible virtual local area network, and then the encapsulated second service traffic message is sent to the tenant gateway; if the next hop interface is not an extensible virtual local area network interface, the step of forwarding the message to the next node is directly executed.

[0097] S303: The tenant gateway executes the corresponding security conversion policy according to the identification label, and generates a reply message.

[0098] In the embodiment, the problem of how the tenant gateway converts the identification label into a security address and the traffic path needs to be solved, and the specific steps can be:

[0099] S303-1: Parse the second service traffic packet to obtain the source IP address and security transfer label of the second service traffic packet;

[0100] S303-2: Based on the matching of the source IP address and the filtering policy, execute different second service traffic packet processing strategies;

[0101] S303-3: If the source IP address matches the filtering policy, the source IP address is converted to a secure address in the secure address pool based on the secure transfer label;

[0102] S303-4: Configure secure traffic paths based on secure addresses and generate response messages;

[0103] In the implementations of S303-1 to S303-4, the tenant gateway processes the second service traffic packet as follows: Figure 8 As shown, firstly, when the second service traffic packet carrying the identification tag arrives at the tenant gateway, it finds that the destination IP of the outer layer is the same as the destination IP of the tenant gateway itself, and then the packet is decapsulated. After decapsulation, it checks whether the source IP of the packet can match the NDproxy entry configured on the tenant gateway, i.e., the filtering policy. If the packet can match the NDproxy entry, it means that the packet can be ND proxied. Then, the tenant gateway's protocol stack detects the source IP of the packet and performs secure address translation based on the STL value in the source IP of the packet, converting the source IP of the original packet to a random IP address from the defined secure address pool. When the tenant gateway performs secure translation, the first traffic packet triggers the generation of a secure entry and performs timed keep-alive. Subsequent packets are directly matched for secure forwarding without going through the full path of translation and checking. If the packet cannot match the NDproxy entry, the step of forwarding the packet to the next node is directly executed.

[0104] In one feasible implementation, the secure address pool is obtained through the following steps:

[0105] During the planning phase of the external network gateway address, a subnet segment is reserved as a secure address pool.

[0106] In this implementation, the definition of a secure address is as follows: a secure address must be an address that is not actually configured on the tenant gateway; this address can only be used to create translation table entries. Simultaneously, the secure address must be on the same network segment as the external gateway address to enable backhaul lookup of the ND proxy table entries. When planning the external gateway address, the user reserves a subnet as a secure address pool. This secure address pool generates randomly translated secure addresses, thus completing the definition of the secure address. Furthermore, the secure address pool uses a random encryption algorithm to convert the source IP address into a secure address.

[0107] In one feasible implementation, the step of configuring a secure traffic path based on a secure address includes:

[0108] Input the secure address and configuration parameters into the secure translation table template to generate a secure traffic path configuration file. The configuration parameters include: translation type, protocol number, destination address, and aging time.

[0109] In this embodiment, such as Figure 9 As shown, the security translation table template includes the translation type (marked as Security Translation ST) and the protocol number. The flag indicates which protocol message is being translated: ALL for all messages, TCP for TCP traffic, and UDP for UDP traffic. The security address is the translated address generated from the security address pool. The destination address is the original message's destination address; setting the destination address ensures that return traffic can match the security translation table entry. The aging timer is set to 60 seconds by default and can be configured. If no match is found within 60 seconds, the translation table entry automatically ages.

[0110] As an example, the first service traffic packet (IPv6-VM1) sent by virtual machine A, with a destination IPv6-1, is TCP and UDP traffic carrying an STL=10 packet that passes through the tenant gateway. The tenant gateway's protocol stack finds that the packet's IP matches the NDproxy entry. Upon checking the first packet, it discovers STL=10, triggering the generation of a security translation entry. Subsequent TCP traffic is then matched against the generated security rules for address translation, with the source address translated to Security-IPv6-1. Non-TCP packets, such as raw IP packets and UDP packets, are forwarded normally without translation. Thus, according to traffic security policy requirements, secure address translation is only performed on TCP traffic, protecting only TCP traffic. Similarly, if STL=01 is detected, it indicates that the user needs to perform source address security translation on all packets sent by the VM. The TGW will translate the source IP of all IPv6 traffic to a random address from the secure address pool before outgoing traffic, protecting the source address from exposure to the public network.

[0111] S304: The tenant gateway interacts with the external gateway for business traffic data based on the reply message.

[0112] In this embodiment, the steps of obtaining a reply message after source address translation and exchanging service traffic data with the external network gateway include:

[0113] S304-1: Send the reply message to the external network gateway;

[0114] S304-2: The external network gateway parses neighbor requests and generates feedback messages;

[0115] S304-3: Request the hardware address of the tenant gateway and send a feedback message to the tenant gateway based on the hardware address;

[0116] S304-4: The tenant gateway forwards the feedback message to the virtual machine.

[0117] In the implementations of S304-1 to S304-4, after the reply message reaches the external network gateway, the external network gateway resolves it and finds that the destination IP is in the same network segment as itself, and sends a message requesting the hardware address of the destination IP. The tenant gateway proxies and replies with its own hardware address. After receiving the reply, the external network gateway sends a feedback message to the tenant gateway. On the tenant gateway, a reverse matching of the security translation table entries is performed to translate the destination IP into the actual virtual machine IPv6 address. The tenant gateway then looks up the host table and forwards the feedback message to the actual virtual machine.

[0118] In this application, by improving and utilizing the reserved fields of the traffic type field of IPv6 packets and the processing flow of the device, the process of tagging IPv6 traffic, defining the secure translation address, secure translation table entries, and the process of secure translation through the tenant gateway are defined, thereby realizing the secure outbound of IPv6 traffic from the cloud network data center.

[0119] The solution of this application will be described below with a complete embodiment, such as... Figure 10 The encapsulation format and traffic path diagram shown illustrates the following: First, an extended virtual LAN tunnel is established between the virtual machine's host machine and the tenant gateway. Then, during extended virtual LAN encapsulation of traffic on the virtual switch, the STL value of the original packet's source IP is modified. Next, upon reaching the tenant gateway, the traffic is decapsulated, and the source IP is checked to see if it matches an NDproxy entry. If a match is found, the STL value is checked, and a security entry is generated. Subsequent packets are then matched against the security entry for source address translation. The translated packets are then routed to the external gateway for outbound traffic. For return traffic, the reply packet, upon reaching the external gateway, finds that the destination IP is on the same network segment as itself and sends a neighbor request packet requesting the hardware address of that destination IP. The tenant gateway proxies and replies with its own hardware address. Upon receiving the reply, the external gateway forwards the packet to the tenant gateway. At the tenant gateway, a reverse security translation entry is performed to translate the destination IP into the actual virtual machine IPv6 address.

[0120] Reference Figure 11 , Figure 11 This is a block diagram illustrating a secure transmission device 1100 for IPv6 traffic in a cloud network according to an exemplary embodiment, such as... Figure 11 As shown, the device 1100 includes:

[0121] The first sending module 1101 is used for the virtual switch to obtain the first service traffic packet sent by the virtual machine;

[0122] The second sending module 1102 is used by the virtual switch to modify the first service traffic packet, add an identification tag to the first service traffic packet, generate a second service traffic packet, and send the second service traffic packet to the tenant gateway.

[0123] The request message generation module 1103 is used by the tenant gateway to execute the corresponding security conversion policy on the second service traffic message according to the identification tag and generate a reply message.

[0124] The interaction module 1104 is used by the tenant gateway to interact with the external network gateway for business traffic data based on the reply message.

[0125] In one feasible implementation, the second transmitting module 1102 includes:

[0126] The parsing submodule is used to parse the first service traffic packet and determine the packet header of the first service traffic packet;

[0127] The identification submodule is used to modify the source IP address in the packet header using a preset process, add an identification tag, and perform scalable virtual LAN encapsulation to generate a second service traffic packet.

[0128] In one feasible implementation, the second transmitting module 1102 further includes:

[0129] The header determination submodule is used to parse the first service traffic packet and determine the header of the first service traffic packet;

[0130] The tag addition submodule is used to modify the source IP address in the packet header using a preset process, add tag information, and perform scalable virtual LAN encapsulation to generate a second service traffic packet.

[0131] In one feasible implementation, the identifier label adding submodule includes:

[0132] The positioning unit is used to locate the traffic data segment in the packet header using a preset process;

[0133] The tag adding unit is used to add secure transfer tags to the reserved fields of traffic data fragments.

[0134] In one feasible implementation, the second transmitting module further includes:

[0135] The message sending module is used to establish a scalable virtual local area network tunnel between the virtual switch and the tenant gateway, and to send the second service traffic message to the tenant gateway through the scalable virtual local area network tunnel.

[0136] In one feasible implementation, the request message generation module 1103 includes:

[0137] The second service traffic packet parsing submodule is used to parse the second service traffic packets to obtain the source IP address and security transfer label of the second service traffic packets;

[0138] The execution submodule is used to execute different second service traffic packet processing strategies based on the matching of the source IP address and the filtering policy;

[0139] The secure address generation submodule is used to convert the source IP address into a secure address from the secure address pool based on the secure transfer label, provided that the source IP address matches the filtering policy.

[0140] The configuration submodule is used to configure secure traffic paths based on secure addresses and generate response messages.

[0141] In one feasible implementation, the configuration submodule includes:

[0142] Input the secure address and configuration parameters into the secure translation table template to generate a secure traffic path configuration file. The configuration parameters include: translation type, protocol number, destination address, and aging time.

[0143] In one feasible implementation, the interaction module includes:

[0144] The reply message sending submodule is used to send reply messages to the external network gateway;

[0145] The feedback message generation submodule is used by the external network gateway to parse neighbor requests and generate feedback messages.

[0146] The feedback message sending submodule is used to request the hardware address of the tenant gateway and send the feedback message to the tenant gateway according to the hardware address.

[0147] The feedback message forwarding submodule is used by the tenant gateway to forward feedback messages to the virtual machine.

[0148] It should be noted that each module in the secure transmission device for IPv6 traffic in the cloud network in this embodiment corresponds one-to-one with each step in the secure transmission method for IPv6 traffic in the cloud network in the aforementioned embodiment. Therefore, the specific implementation of this embodiment can refer to the implementation of the secure transmission method for IPv6 traffic in the cloud network in the aforementioned embodiment, and will not be repeated here.

[0149] Based on the same inventive concept, embodiments of this application also provide an electronic device, the electronic device comprising:

[0150] At least one processor; and,

[0151] A memory that is communicatively connected to at least one processor; wherein,

[0152] The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to perform a method for secure transmission of IPv6 traffic in a cloud network.

[0153] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements a method for secure transmission of IPv6 traffic in a circuit board cloud network.

[0154] Based on the same inventive concept, embodiments of this application also provide a computer program product that, when processed, implements a method for secure transmission of IPv6 traffic in a cloud network.

[0155] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a device including one or any combination of the above-mentioned memories. The computer may be a variety of computing devices, including smart terminals and servers.

[0156] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0157] As an example, executable instructions may, but do not necessarily, correspond to a file in a file device. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0158] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0159] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0160] The above provides a detailed description of a secure IPv6 traffic transmission method in a cloud network. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for secure transmission of IPv6 traffic in a cloud network, characterized in that, The method comprises: The virtual switch obtains the first service traffic message sent by the virtual machine; The virtual switch transforms the first service traffic message, adds an identification tag to the first service traffic message, generates a second service traffic message, and sends the second service traffic message to the tenant gateway; The tenant gateway executes a corresponding security conversion strategy on the second service traffic message according to the identification tag, and generates a reply message; The tenant gateway performs service traffic data interaction with the external network gateway according to the reply message; The step of transforming the first service traffic message, adding an identification tag to the first service traffic message, and generating a second service traffic message comprises: The first service traffic message is parsed to determine the message header of the first service traffic message; The source IP address of the message header is modified using a preset process, an identification tag is added, and VXLAN encapsulation is performed to generate a second service traffic message; The step of sending the second service traffic message to the tenant gateway comprises: An VXLAN tunnel is established between the virtual switch and the tenant gateway, and the second service traffic message is sent to the tenant gateway through the VXLAN tunnel; The step of executing a corresponding security conversion strategy on the second service traffic message according to the identification tag to generate a reply message comprises: The second service traffic message is parsed to obtain the source IP address and security transfer tag of the second service traffic message; Different second service traffic message processing strategies are executed according to the matching of the source IP address and the screening strategy; In the case of matching of the source IP address and the screening strategy, the source IP address is converted into a security address in a security address pool according to the security transfer tag; A security traffic path is configured according to the security address, and the reply message is generated; The step of modifying the source IP address of the message header using a preset process and adding an identification tag comprises: The traffic data segment of the message header is located using a preset process; A security transfer tag is added to the reserved field of the traffic data segment.

2. The method for secure transmission of IPv6 traffic in cloud network according to claim 1, characterized in that, The security address pool is obtained by the following steps: During the planning phase of the external network gateway address, a subnet segment is reserved as a security address pool, wherein the security address pool converts the source IP address into the security address using a random encryption algorithm.

3. The method for secure transmission of IPv6 traffic in cloud network according to claim 1, characterized in that, The step of configuring a security traffic path according to the security address comprises: The security address and configuration parameters are input into a security conversion table item template to generate a security traffic path configuration file, wherein the configuration parameters include conversion type, protocol number, destination address, and aging time.

4. The method for secure transmission of IPv6 traffic in cloud network according to claim 1, characterized in that, The step of performing service traffic data interaction with the external network gateway according to the reply message comprises: The reply message is sent to the external network gateway; The external network gateway parses the neighbor request and generates a feedback message; The hardware address of the tenant gateway is requested, and the feedback message is sent to the tenant gateway according to the hardware address; The tenant gateway forwards the feedback message to the virtual machine.

5. A device for secure transmission of IPv6 traffic in a cloud network, characterized by, The apparatus comprises: A first sending module, configured to acquire, by a virtual switch, a first service traffic message sent by a virtual machine; A second sending module, configured to perform modification on the first service traffic message by the virtual switch, add an identification tag to the first service traffic message, generate a second service traffic message, and send the second service traffic message to a tenant gateway; A request message generation module, configured to execute a corresponding security conversion strategy on the second service traffic message according to the identification tag by the tenant gateway, and generate a reply message; An interaction module, configured to perform service traffic data interaction with an external network gateway according to the reply message by the tenant gateway.

6. The apparatus for secure transmission of IPv6 traffic in a cloud network as claimed in claim 5, wherein, The second sending module comprises: An analysis submodule, configured to analyze the first service traffic message, and determine a message header of the first service traffic message; An identification submodule, configured to modify a source IP address of the message header by using a preset process, add an identification tag, and perform extensible virtual local area network encapsulation, to generate a second service traffic message.

Images