An IP network segment accurate method, device and storage medium

Abstract

The application provides an IP network segment accurate method, device and storage medium. The method comprises the following steps: converting a preset IP address set into a binary address set; dividing the IP address set into several sub-network segments by the following steps: determining an intermediate end address according to a start address of a to-be-divided sub-network segment; when the intermediate end address is not more than an end address of the binary address set, determining a mask length of a sub-network segment where an IP address corresponding to the start address is located, the mask length being a number of bits of a network number in the IP address set representing the same network number in the mask; determining the to-be-divided sub-network segment based on the IP address corresponding to the start address and the mask length; and when the end address of the determined sub-network segment is the end address of the preset IP address set, determining a set of the sub-network segments as a target IP network segment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network communication, and in particular to an IP network segment accurate method and device and storage medium. BACKGROUND

[0002] VPN (Virtual Private Network) is a temporary and secure connection established through the Internet, which is a secure and stable communication tunnel passing through the public network to the enterprise intranet. The virtual private network is an extension of the enterprise intranet. The virtual private network can help remote users, company branches, business partners and suppliers to establish a trusted and secure connection with the intranet of the company and ensure the secure transmission of data. However, in order to ensure the normal use of VPN, it is necessary to build a VPN networking environment in advance, and it is necessary to configure the IP network segment corresponding to the set of IP addresses allowed to enter the intranet on the VPN gateway. In the prior art, the IP address is configured by the start IP, the end IP and the subnet mask. This configuration method can only configure the IP address range to a complete IP network segment containing the IP range. However, nowadays, when configuring the IP addresses allowed to enter the intranet, each enterprise no longer satisfies the range of a complete IP network segment. SUMMARY

[0003] Therefore, the present application provides an IP network segment accurate method, device and storage medium to solve the above-mentioned defects in the related art.

[0004] The first aspect of the present application provides an IP network segment accurate method, which comprises:

[0005] Converting a preset IP address set into a binary address set;

[0006] Dividing the IP address set into a plurality of subnet segments by the following steps:

[0007] Determining the intermediate end address according to the start address of the subnet segment to be divided; the subnet segment to be divided is a subset of the IP address set capable of communicating with the intranet through the VPN; the intermediate end address is the binary address obtained by replacing the last N 0s in the start address with 1 from high to low; the start address of the subnet segment to be divided is the next address of the intermediate end address of the previous divided subnet segment; and the end address of the subnet segment is the IP address corresponding to the intermediate end address;

[0008] When the intermediate end address does not exceed the end address of the binary address set, determining the mask length of the subnet segment where the IP address corresponding to the start address is located, and the mask length is the number of bits of the network number in the IP address set representing the same network number in the mask;

[0009] determine the subnet segment to be divided based on the IP address corresponding to the start address and the mask length;

[0010] When the end address of the determined subnet segment is the end address of the preset IP address set, determine the set of each subnet segment as the target IP network segment.

[0011] The second aspect of the present application provides an IP network segment accurate device, the device comprises:

[0012] The base conversion unit is configured to convert the preset IP address set into a binary address set.

[0013] The subnet segment division unit is configured to determine an intermediate end address based on the start address of the subnet segment to be divided; the subnet segment to be divided is a subset of the IP address set capable of communicating with the internal network through the VPN; the intermediate end address is a binary address obtained by replacing N continuous 0s from the end to the high bit of the start address with 1s; the start address of the subnet segment to be divided is the next address of the intermediate end address of the previous divided subnet segment; and the end address of the subnet segment is the IP address corresponding to the intermediate end address.

[0014] When the intermediate end address does not exceed the end address of the binary address set, determine the mask length of the subnet segment in which the IP address corresponding to the start address is located, and the mask length is the number of bits of the network number in the mask in the IP address set representing the same network number.

[0015] determine the subnet segment to be divided based on the IP address corresponding to the start address and the mask length;

[0016] When the end address of the determined subnet segment is the end address of the preset IP address set, determine the set of each subnet segment as the target IP network segment.

[0017] The third aspect of the present application provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the steps in the method of the first aspect of the present application.

[0018] The preset IP address set is first converted into binary to obtain a binary IP address set containing only 0 and 1; then the middle end address is determined by replacing the N continuous 0 from the end of the start address of the subnet segment to be divided with 1, wherein the start address of the subnet segment to be divided is the next address of the middle end address of the previous divided subnet segment, and the end address of the subnet segment is the IP address corresponding to the middle end address; when the middle end address does not exceed the end address of the binary address set, the mask length of the subnet segment in which the IP address corresponding to the start address is located can be determined based on the value of N, and the current subnet segment to be divided can be determined based on the IP address corresponding to the start address and the mask length according to the subnet calculation method. By repeating the above steps, a plurality of IP subnets not exceeding the preset IP address set can be obtained, and when the middle end IP address of the last IP subnet is the end IP address in the set IP address, the set of all IP subnets is the target IP subnet. Compared with the IP subnet calculation method of the prior art, the IP subnet calculation of the present application can calculate a set of more accurate IP subnets from the required IP range, avoid the situation that the calculated IP address set includes unnecessary parts due to the fact that the required IP range is not a complete IP subnet, and thus abnormal situations occur during VPN network communication, further accurate IP address configuration is achieved, and the use safety of the VPN network environment is improved.

[0019] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 is a VPN networking architecture diagram according to an exemplary embodiment of the present application;

[0022] Figure 2 is a flowchart of an IP subnet accurate method according to an exemplary embodiment of the present application;

[0023] Figure 3 is a flowchart of an IP subnet accurate method according to an exemplary embodiment of the present application;

[0024] Figure 4 is a flowchart of an IP subnet accurate method according to an exemplary embodiment of the present application;

[0025] Figure 5 is a flowchart of an IP subnet accurate method according to an exemplary embodiment of the present application;

[0026] Figure 6 is a block diagram of an IP subnet refinement apparatus according to an example embodiment of the present application;

[0027] Figure 7 is a block diagram of an IP subnet refinement apparatus according to an example embodiment of the present application. DETAILED DESCRIPTION

[0028] The example embodiments will now be described in detail with reference to the accompanying drawings. The following description is made with reference to the accompanying drawings, in which like reference numerals refer to like elements, and in which:

[0029] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It also will be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0030] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used only as a shorthand notation to first, second, third, etc. terms in describing various embodiments. For example, a first information can also be termed a second information, and similarly, a second information can also be termed a first information, without departing from the scope of the present application. As used herein, the term "if' can be construed to mean "when" or "in response to determining" or "in response to a determination" that a certain condition precedent has been satisfied or obtained, unless and except the context clearly indicates otherwise.

[0031] For the purpose of facilitating understanding, some concepts related to the present application are explained as follows:

[0032] IP address (Internet Protocol Address) is the Internet Protocol address, also known as Internet Protocol address. IP address is a uniform address format provided by IP protocol, which allocates a logical address for each network and each host on the Internet, so as to shield the difference of physical address. IP address is usually represented in the form of "decimal point" (a.b.c.d), in which a, b, c and d are decimal integers between 0 and 255. For example: decimal point IP address (192.4.5.6) can also be represented as 32-bit binary number. In the case of 32-bit binary number, IP address is usually divided into four 8-bit binary numbers, so the above decimal IP address can be represented as (11000000.00000100.00000101.00000110).

[0033] Subnet mask (Subnet Mask) is also called network mask, address mask and subnet mask, which is a 32-bit binary value applied to TCP / IP network. The subnet mask we usually see is the subnet mask converted into decimal point form, such as (255.255.255.0). It can mask part of the IP address, so as to separate the network part and host part of the IP address. Based on the subnet mask, the administrator can further divide the network into several subnets. It must be used together with IP address. For example, the above example of decimal point IP address (192.4.5.6), general IP address is composed of "network number + host number", that is, network part + host part, and the function of subnet mask is to mask the host part of the current IP address. Assuming that the subnet mask of the above IP address (192.4.5.6) is (255.255.255.0), it means that the first 24 bits (the first three digits in decimal point) of the binary IP address represent the network part, and the last 6 bits represent the host part. Then the network identifier of the current IP address can be obtained as (192.4.5.0), which is used to identify the network where the IP address is located, and the masked host part represents the specific device host corresponding to the current IP address.

[0034] Network segment (Network Segment) generally refers to the part of a computer network that can directly communicate using the same physical layer device (transmission medium, repeater, hub, etc.). The same network segment refers to the same network address obtained by performing bitwise AND operation on IP address and subnet mask. The network identifier of the same network segment is the same network identifier. In order to be in the same network segment, the network identifier must be the same. The network identifier algorithm of various IP is different, which needs to be judged according to the number of bits of subnet mask.

[0035] Gateway, also known as network connector, protocol converter. It is a "gateway" of one network (network segment) connected to another network (network segment). According to different classification standards, there are many kinds of gateways. The gateway in TCP / IP protocol is the most commonly used, and the "gateway" in this application means the gateway under TCP / IP protocol by default. The default gateway realizes network interconnection at the network layer. The structure of the gateway is similar to that of the router, except for the interconnection layer. Gateway can be used for wide area network interconnection and local area network interconnection. Gateway is essentially an IP address of a network leading to other networks. For example, there are network A and network B, the IP address range of network A is "192.168.1.1~192.168.1.254", and the subnet mask is 255.255.255.0; the IP address range of network B is "192.168.2.1~192.168.2.254", and the subnet mask is 255.255.255.0. Without a router, the two networks cannot communicate with each other via TCP / IP protocol. Even if the two networks are connected to the same switch (or hub), the TCP / IP protocol will determine that the hosts in the two networks are in different networks according to the subnet mask (255.255.255.0). To realize communication between the two networks, a gateway must be used. If the host in network A finds that the destination host of the data packet is not in the local network, it forwards the data packet to its own gateway, which forwards it to the gateway of network B, and the gateway of network B forwards it to a host in network B. Therefore, only by setting the IP address of the gateway, can TCP / IP protocol realize the mutual communication between different networks. The IP address of the gateway is the IP address of the device with routing function, and the devices with routing function include routers, servers enabled with routing protocol (essentially equivalent to a router), proxy servers (also equivalent to a router) and the like.

[0036] Zero Trust Security: Zero Trust represents a new generation of network security protection concept. Its key is to break the default "trust", and in a popular way, it can be summarized as "continuous verification, never trust". By default, no one, device and system inside and outside the enterprise network is trusted, and the trust basis of access control is reconstructed based on identity authentication and authorization, so as to ensure that the identity is trusted, the device is trusted, the application is trusted and the link is trusted. Based on the principle of zero trust, the security of the office system can be guaranteed: terminal security, link security and access control security.

[0037] A Virtual Private Network (VPN) is a temporary, secure connection established over the internet, serving as a secure and stable communication tunnel through a public network to a company's intranet. A VPN extends the corporate intranet, enabling remote users, branch offices, business partners, and suppliers to establish trusted and secure connections with the company's internal network and ensuring secure data transmission. VPNs include IPSec VPNs and SSL VPNs; this application does not limit the VPN category. Taking SSL VPN as an example, SSL VPN refers to a new type of VPN technology that uses the SSL protocol to encrypt IP data links for remote access. Because the SSL protocol is widely built into various browsers such as IE, SSL VPNs, which use SSL for authentication and data encryption, are characterized by simple deployment, no client required, low maintenance costs, and strong network adaptability.

[0038] To ensure the proper functioning of a VPN, the VPN network environment needs to be set up in advance. For example... Figure 1 The diagram shown is an exemplary embodiment illustrating a VPN network architecture. In the diagram, the zero-trust SSL VPN client 11 on the PC creates an SSL VPN tunnel 14 with the zero-trust VPN gateway 12 via the Internet. The zero-trust SSL VPN client 11 obtains a virtual IP address for communicating with the intranet server 13 through the SSL VPN tunnel 14.

[0039] However, to successfully communicate with the internal network, you need to configure the corresponding IP network segment on the VPN gateway, which is set of IP addresses that are allowed to enter the internal network.

[0040] In the related art, IP address configuration is performed by using a start IP, an end IP and a subnet mask. This configuration method can only configure an IP address range to an entire IP network segment containing the IP range. However, nowadays, when configuring IP addresses allowed to enter an intranet, an enterprise no longer satisfies the range of an entire IP network segment. For example, a user wants to configure an IP range of (2.0.1.2-2.0.1.254). Without knowing the subnet mask, the subnet mask needs to be calculated first, and then the IP network segment is calculated according to the subnet mask and the IP address range. Assuming that the subnet mask is calculated as (255.255.255.0), the network identification, i.e., the network address, can be obtained by performing a bitwise AND operation on the start address and the subnet mask, which is (2.0.1.0). Since the first 24 bits of the subnet mask are all 1, the mask length can be determined as 24, and thus the IP network segment is (2.0.1.0 / 24). The IP address set under the IP network segment is the IP address set allowed to communicate with the intranet through a VPN gateway. However, it is observed that the actual IP address range contained in the network segment is all the IP addresses from the network address (2.0.1.0) to (2.0.1.255), which obviously exceeds the IP address range set by the user to be allowed to communicate with the intranet through the VPN gateway.

[0041] Therefore, there is an urgent need for a method capable of further accurately configuring an IP address, and capable of realizing that the configured IP network segment does not contain IP addresses not allowed to pass through a VPN gateway.

[0042] The inventor finds that the key to solving the problem is to further divide the IP network segment. For the mask length in the IP network segment, the greater the mask length value, the smaller the IP address range represented by the corresponding IP network segment. Therefore, the IP address range set by the user can be reduced to a plurality of sub-network segments within the range by using a certain method, so that the entire sub-network segment set constitutes the preset IP address range.

[0043] Therefore, the technical solution of the present application will be described in detail in combination with embodiments.

[0044] Figure 2 is a flowchart of an IP network segment accurate method according to an exemplary embodiment of the present application. The method comprises the following steps:

[0045] In step 202, a preset IP address set is converted into a binary address set.

[0046] In the embodiment of the present method, the IP address set is divided into a plurality of sub-network segments by the following steps:

[0047] In step 204, an intermediate end address is determined according to the start address of the sub-network segment to be divided.

[0048] Step 206, when the intermediate end address does not exceed the end address of the binary address set, determining the mask length of the subnet segment where the IP address corresponding to the start address is located;

[0049] Step 208, determining the subnet segment to be divided based on the IP address corresponding to the start address and the mask length;

[0050] Step 210, when the end address of the determined subnet segment is the end address of the preset IP address set, determining the set of each subnet segment as the target IP network segment.

[0051] In one embodiment, it needs to be explained for step 202 that when configuring the VPN networking environment, the related art is to set the IP start address and the IP end address, that is Figure 1 The corresponding method embodiment, the preset IP address set, also set the corresponding subnet mask; if the corresponding subnet mask is unknown, the corresponding subnet mask is also calculated through other algorithms, for example, the subnet mask is solved by knowing the number of subnets, or the number of hosts is solved, and this way can only solve the IP network segment of the IP address range in a certain type of IP address, for example, the IP range under the B class IP address, the network number is defaulted to 16 bits, and the host number is also defaulted to 16 bits, the network number of the C class IP address range is defaulted to 24 bits, and the host number is defaulted to 8 bits, the default subnet mask is calculated through the default network number and host number, and then the default subnet mask is further refined through the number of subnets or hosts, which will make the calculation steps complicated, and the calculation conditions must be met to calculate, which makes it difficult to meet the calculation conditions, and the finally calculated IP network segment may still contain the IP addresses in the preset IP address set that are not needed. The scheme of the present application only needs to know the above preset address set, and can perform specific calculation of the IP network segment, simplifies the calculation process, and avoids the calculation range of the IP network segment to be too large to contain the IP addresses outside the range of the preset IP address set.

[0052] In one embodiment, it needs to be explained for step 204 that the subnet segment to be divided is a subset of the IP address set that can communicate with the intranet through the VPN. The technical scheme of the present application accurately divides the IP network segment within the preset IP address set, so that the solved IP network segment does not exceed the range of the preset IP address set, and the IP network segment of the preset IP address set is accurately divided.

[0053] In one embodiment, it is necessary to explain that the intermediate end address is the binary address after replacing the N 0s from the end to the high bit of the start address with 1; the way of determining the intermediate end address is related to the representation range of the IP network segment: for example, the IP address range represented by the IP network segment (192.168.1.0 / 24) is all the IP addresses from 0 to the upper limit of the last 8 bits except the first 24 bits (the first 24 bits in binary form, which is equivalent to the first three values in decimal form), i.e. (192.168.1.0~192.168.1.255), and the range of the last 8 bits in binary form is (*.*.*.00000000~*.*.*.11111111, * represents the unchanged value of the first 24 bits). In other words, finding the subnet segment between the start address and the end address of the preset IP address set is to find how many combinations of the start address with N 0s at the end and the end address with N 1s at the end. This application starts from the end bit, so it starts from a small range first, and when the IP network segment of the small range does not meet the requirements, it expands to a larger range. The determined IP network segment is more accurate and does not miss any IP address.

[0054] In one embodiment, it is necessary to explain that the start address of the subnet segment to be divided is the next address of the intermediate end address of the previous divided subnet segment; and the end address of the subnet segment is the IP address corresponding to the intermediate end address.

[0055] In one embodiment, it is necessary to explain that the mask length is the number of bits of the network number in the IP address set representing the same network number. Since the IP address has a total of 32 bits, and the IP network segment

[0056] The subnet segment determined in the above embodiment is by default not more than the IP address range preset by the user. The following embodiments introduce the case where the determined subnet segment exceeds the IP address range preset by the user.

[0057] Figure 3 is a flowchart of an IP network segment accurate method according to an exemplary embodiment, and the method further comprises:

[0058] Step 302, when the intermediate end address exceeds the end address of the binary address set, determining the mask length;

[0059] Step 304, when the mask length is greater than 0, reducing N by 1;

[0060] Step 306, updating the intermediate end address according to the start address of the subnet segment to be divided and the updated value of N.

[0061] In one embodiment, for step 306, it is also necessary to point out that the updated middle end address is the binary address after replacing the N consecutive 0s from the end to the high bit of the start address of the subnet segment to be divided with 1. Figure 3 The embodiment introduced is the case where the middle end address exceeds the end address of the binary address set. In this case, the middle end address needs to be updated, i.e., the value of the middle end address is correspondingly reduced. Specifically, for example, the current updated start address is (1.2.3.192) and the determined middle end address is (1.2.3.255). At this time, according to the above formula, the end address of the binary IP address set converted back from the preset IP address set is (1.2.3.239), wherein 192, 255 and 223 are represented in binary as 11000000, 11111111 and 11011111 respectively. The middle end address exceeds the end address of the binary address set, at which time the above-mentioned updating of the middle end address is needed. Figure 2 In the related embodiment, N=6, the mask length is 32-6=26, and the end address of the binary IP address set converted back from the preset IP address set is (1.2.3.239), wherein 192, 255 and 223 are represented in binary as 11000000, 11111111 and 11011111 respectively. The middle end address exceeds the end address of the binary address set, at which time the above-mentioned updating of the middle end address is needed. Figure 3 The steps of the related embodiment are as follows: first, it is judged that the current mask length 26 is greater than 0, N-1 is changed to 5, and the middle end address is updated to 11011111 through step 306, i.e., the N consecutive 0s from the end of the start address are replaced with 1. At this time, the middle end address is equal to the end address of the binary address set. Therefore, after the current subnet segment is determined, all the determined subnet segment set is all the IP subnet segments contained in the preset IP address set.

[0062] Figure 4 is a flowchart of an IP subnet segment accurate method according to an example embodiment. The method further includes:

[0063] Step 402: when the start address of the subnet segment to be divided is not 0 at the end, the IP address corresponding to the start address of the subnet segment to be divided is determined as a sub-IP subnet segment containing only one IP address.

[0064] Step 404: the next address of the start address of the subnet segment to be divided is determined as the start address of the new subnet segment to be divided.

[0065] In one embodiment, it is necessary to point out that Figure 4 The related embodiment is the case where the subnet range calculation is not satisfied, specifically, when the end of the current start address is 1, it is determined that it is itself an IP subnet segment, and this IP subnet segment is a subnet segment containing only the current IP address. At this time, the mask length of the current subnet segment is the total number of bits of the IP address, i.e., 32.

[0066] Figure 5 is a flowchart of an IP subnet segment accurate method according to an example embodiment. The method further includes:

[0067] Step 502, when the start address of the subnet segment to be divided is the end address of the binary address set, the IP address corresponding to the start address of the subnet segment to be divided is determined as the subnet segment with only one IP address.

[0068] Step 504, the set of each subnet segment is determined as the target IP network segment.

[0069] In an embodiment, it is to be noted that, Figure 5 The related embodiment is a special calculation ending condition, i.e. when the current start address is directly the last address of the binary address set converted from the preset IP address set, at this time, the current IP address is directly output as an IP network segment. Figure 4 The related embodiment is a special calculation ending condition, i.e. when the current start address is directly the last address of the binary address set converted from the preset IP address set, at this time, the current IP address is directly output as an IP network segment.

[0070] In an embodiment, the IP network segment accurate method further comprises the steps of:

[0071] When the start address of the subnet segment to be divided exceeds the end address of the binary address set, the set of each subnet segment is determined as the target IP network segment.

[0072] In an embodiment, it is to be noted that, the above embodiment is another calculation ending condition, i.e. when the current determined start address exceeds the end address of the binary address set, the set of the current calculated network segment is directly determined as all the IP network segments contained in the preset IP address set.

[0073] The IP network segment accurate method of the present application is described below with a specific embodiment. Assuming that the preset IP address set set by the user is (2.0.2.3~2.0.2.203), the preset address set is configured into the VPN gateway in the form of network segment, which needs to be performed as follows:

[0074] First, the preset IP address set is converted into a binary address set, i.e. converted into (00000010.00000000.00000010.00000011~00000020.00000000.00000010.11001011). Since the first 24 bits of the address set are completely identical, and the subsequent calculation process is also not much related to the value of the first 24 bits, for the convenience of description, only the change of the last 8 bits is written out, which is used to represent the change of the entire IP address.

[0075] Starting from the first subnet segment to be divided, the start address, i.e. the start address of the binary address set (00000011), the end of the start address of the subnet segment to be divided is not 0, and the steps in the above embodiment are executed: the IP address corresponding to the start address of the subnet segment to be divided is determined as the subnet segment with only one IP address, and the mask length of the subnet segment with only one IP address is 32, so the first IP subnet segment determined is (00000011 / 32).

[0076] The step is continued to be executed: the next address of the start address of the subnet segment to be divided is determined as the start address of the new subnet segment to be divided, so the new start address is (00000100), and at this time, the condition is met Figure 2 The steps of the related embodiments: the intermediate end address is determined according to the start address of the subnet segment to be divided; wherein the current start address has continuous 2 0s from the end to the high bit, so N=2, and at this time, the intermediate end address obtained after replacement is (00000111), and the corresponding mask length is 32-2=30, so the current subnet segment is determined as (00000100 / 30) based on the IP address corresponding to the start address and the mask length.

[0077] Continuing to perform the above steps, the new starting address is (00001000), at this time the current starting address has 3 consecutive 0s from the end to the high bit, so N=3, and the intermediate ending address is (00001111), and the mask length is 29, so the determined current subnet segment is (00001000 / 29); according to the same steps, it can be calculated that the subsequent IP subnet segments are (00010000 / 28), (00100000 / 27) and (01000000 / 26). When calculating to the network segment (01000000 / 26), the intermediate ending address of the current network segment is (01111111), so the next new starting address is (10000000), at this time the current starting address has 7 consecutive 0s from the end to the high bit, so N=7, and the intermediate ending address is (11111111); at this time, the intermediate ending address exceeds the ending address (11001011) of the preset address set conversion binary address set, at this time the case in the above embodiment is met, and the following steps are performed: because the intermediate ending address exceeds the ending address of the binary address set, at this time the mask length is 32-7=25 greater than 0, N is reduced by 1, that is, N becomes 6, and the intermediate ending address is updated according to the starting address of the subnet segment to be divided and the updated N value, and the specific updating manner is that the starting address (10000000) of the current subnet segment to be divided is replaced by a binary address in which N consecutive 0s from the end to the high bit of the starting address are replaced by 1, that is, the updated intermediate ending address is (10111111), at this time the mask length is 26, and the updated intermediate ending address does not exceed the ending address of the binary address set, so the current subnet segment can be determined to be (10000000 / 26).

[0078] The new start address is the next address of the above intermediate end address (10111111), i.e. (11000000), and N=6 is calculated according to the above steps, and the intermediate end address is (11111111), which exceeds the end address of the binary address set, so the following steps are performed: judging that the mask length 32-6=26 is greater than 0 at this time, N is reduced by 1, i.e. N becomes 5, and the intermediate end address is updated according to the start address of the subnet segment to be divided and the updated value of N, i.e. the binary address after replacing the N consecutive 0s from the end of the start address (11000000) of the current subnet segment to the high bit with 1 is the updated intermediate end address, i.e. (11011111), and the mask length at this time is 27. The updated intermediate end address still exceeds the end address (11001011) of the binary address set, so it is continuously judged that the mask length 27 is greater than 0 at this time, N is reduced by 1, i.e. N becomes 4, and the intermediate end address is updated according to the start address of the subnet segment to be divided and the updated value of N, i.e. the binary address after replacing the N consecutive 0s from the end of the start address (11000000) of the current subnet segment to the high bit with 1 is the updated intermediate end address, i.e. (11001111), and the mask length at this time is 28. The updated intermediate end address still exceeds the end address (11001011) of the binary address set, so it is continuously judged that the mask length 28 is greater than 0 at this time, N is reduced by 1, i.e. N becomes 3, and the intermediate end address is updated according to the start address of the subnet segment to be divided and the updated value of N, i.e. the binary address after replacing the N consecutive 0s from the end of the start address (11000000) of the current subnet segment to the high bit with 1 is the updated intermediate end address, i.e. (11000111), and the mask length at this time is 29; the updated intermediate end address does not exceed the end address (11001011) of the binary address set, so it can be determined that the current subnet segment is (11000000 / 29).

[0079] The new start address is the next address of the above-mentioned intermediate end address (11000111), that is, (11001000), and N=3 is calculated according to the above-mentioned steps, the intermediate end address is (11001111), which exceeds the end address of the binary address set, and the mask length is 32-3=29 at this time, so the following steps are executed again: judging that the mask length 29 at this time is greater than 0, N is reduced by 1, that is, N becomes 2, and the intermediate end address is updated according to the start address of the subnet segment to be divided and the updated value of N, that is, the binary address obtained by replacing the N consecutive 0 from the end of the start address (11001000) of the current subnet segment to the high bit with 1, that is, the updated intermediate end address is (11001011), and the mask length at this time is 32-2=30; the updated intermediate end address is equal to the end address (11001011) of the binary address set, so it can be determined that the current subnet segment is (11001000 / 30), and the set of all subnet segments currently determined is the target subnet set required by us, that is, the IP address set that can communicate with the intranet through the VPN. In the case where the last digit of the decimal IP address is used to represent the address itself, the IP range of the first subnet segment (00000011 / 32) is 3, the IP range of the second subnet segment (00000100 / 30) is 4-7, the IP range of the third subnet segment (00001000 / 29) is 8-15, the IP range of the fourth subnet segment (00010000 / 28) is 16-31, the IP range of the fifth subnet segment (00100000 / 27) is 32-63, the IP range of the sixth subnet segment (01000000 / 26) is 64-127, the IP range of the seventh subnet segment (10000000 / 26) is 128-191, the IP range of the eighth subnet segment (11000000 / 29) is 192-199, and the IP range of the ninth subnet segment (11001000 / 30) is 200-203. As can be seen from the above results, all IP addresses in the preset IP address set are included in the above-determined subnet set, and no other IP addresses are included, thereby achieving further accurate IP subnet division.

[0080] The application also provides a device embodiment corresponding to the method, which will be described in detail in the following embodiments.

[0081] Figure 6 It is an IP subnet accurate device block diagram according to an exemplary embodiment of the application, and the device comprises:

[0082] The binary conversion unit 601 is configured to convert the preset IP address set into a binary address set.

[0083] The subnet segment division unit 602 is configured to determine a middle end address according to a start address of a subnet segment to be divided; the subnet segment to be divided is a subset of an IP address set capable of communicating with an intranet through a VPN; the middle end address is a binary address obtained by replacing N continuous 0s from a high bit of the start address with 1s from the end; the start address of the subnet segment to be divided is a next address of the middle end address of a previous divided subnet segment; and the end address of the subnet segment is an IP address corresponding to the middle end address.

[0084] When the middle end address is not more than the end address of the binary address set, a mask length of a subnet segment in which the IP address corresponding to the start address is located is determined, and the mask length is a number of bits of a network number in the mask set representing the same network number;

[0085] The subnet segment to be divided is determined based on the IP address corresponding to the start address and the mask length.

[0086] When the end address of the determined subnet segment is an end address of a preset IP address set, a collection of the subnet segments is determined as a target IP network segment.

[0087] Figure 7 is a block diagram of an IP network segment accurate device according to an example embodiment. The device further includes:

[0088] The address updating unit 703 is configured to, when the middle end address is more than the end address of the binary address set, determine that the mask length is greater than 0, reduce N by 1, and update the middle end address according to the start address of the subnet segment to be divided and the updated N, wherein the updated middle end address is a binary address obtained by replacing N continuous 0s from a high bit of the start address of the subnet segment to be divided with 1s from the end.

[0089] In an embodiment, the subnet segment division unit 602 in the IP network segment accurate device is further configured to:

[0090] When the start address of the subnet segment to be divided is not 0 from the end, the IP address corresponding to the start address of the subnet segment to be divided is determined as a subnet segment having only one IP address.

[0091] A next address of the start address of the subnet segment to be divided is determined as a start address of a new subnet segment to be divided.

[0092] In an embodiment, the subnet segment division unit 602 in the IP network segment accurate device is further configured to:

[0093] When the start address of the subnet segment to be divided is the end address of the binary address set, the IP address corresponding to the start address of the subnet segment to be divided is determined as a subnet segment having only one IP address.

[0094] determine the set of subnets as the target IP subnet.

[0095] In one embodiment, the subnet dividing unit 602 in the IP subnet precision apparatus is further configured to:

[0096] determine the set of subnets as the target IP subnet when the start address of the subnet to be divided exceeds the end address of the binary address set.

[0097] The application further provides a computer readable storage medium, which stores a computer program. The program is executed by a processor to implement the steps of any IP subnet precision method provided by the application.

[0098] In particular, the computer readable medium suitable for storing computer program instructions and data includes all forms of non-volatile memory, media and memory devices, such as semiconductor memory devices (e.g. EPROM, EEPROM and flash memory devices), magnetic disks (e.g. internal hard disks or removable disks), magneto-optical disks, and CD ROM and DVD-ROM disks.

[0099] The above merely describes the preferred embodiments of the application, but not used to limit the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A method for accurately determining IP network segments, characterized in that, The method includes: Convert the preset IP address set into a binary address set; The IP address set is divided into several subnets using the following steps: The intermediate end address is determined based on the start address of the subnet segment to be divided; the subnet segment to be divided is a subset of the set of IP addresses that can communicate with the intranet via VPN; the intermediate end address is the binary address obtained by replacing N consecutive 0s with 1s from the end of the start address; the start address of the subnet segment to be divided is the address following the intermediate end address of the previous subnet segment; the end address of the subnet segment to be divided is the IP address corresponding to the intermediate end address. When the intermediate end address does not exceed the end address of the binary address set, the mask length of the subnet segment where the IP address corresponding to the start address is located is determined, and the mask length is the number of bits of the network number in the set of IP addresses representing the same network number in the mask; The subnet to be divided is determined based on the IP address corresponding to the starting address and the mask length; When the end address of the determined subnet segment is the end address of the preset IP address set, the set of subnet segments is determined as the target IP network segment.

2. The method according to claim 1, characterized in that, The method further includes: When the intermediate end address exceeds the end address of the binary address set, if the mask length is greater than 0, then N is decremented by one, and the intermediate end address is updated according to the start address of the subnet segment to be divided and the updated value of N. The updated intermediate end address is the binary address after replacing the N consecutive 0s with 1s from the end to the high-order bits of the start address of the subnet segment to be divided.

3. The method according to claim 1, characterized in that, The method further includes: When the starting address of the subnet to be divided is not 0 at the end, the IP address corresponding to the starting address of the subnet to be divided is determined as a subnet with only one IP address. The address following the starting address of the subnet segment to be divided is determined as the new starting address of the subnet segment to be divided.

4. The method according to claim 1, characterized in that, The method further includes: When the starting address of the subnet segment to be divided is the ending address of the binary address set, the IP address corresponding to the starting address of the subnet segment to be divided is determined as a subnet segment with only one IP address. The set of all subnets is determined as the target IP network segment.

5. The method according to claim 1, characterized in that, The method further includes: When the starting address of the subnet to be divided exceeds the ending address of the binary address set, the set of subnets is determined as the target IP network segment.

6. A device for precise IP network segment positioning, characterized in that, The device includes: The number system conversion unit is used to convert a preset IP address set into a binary address set; A subnet segmentation unit is used to determine intermediate end addresses based on the start address of the subnet segment to be divided; the subnet segment to be divided is a subset of the set of IP addresses that can communicate with the intranet via VPN; the intermediate end address is a binary address obtained by replacing N consecutive 0s with 1s from the end of the start address; the start address of the subnet segment to be divided is the address following the intermediate end address of the previous subnet segment; the end address of the subnet segment to be divided is the IP address corresponding to the intermediate end address. When the intermediate end address does not exceed the end address of the binary address set, the mask length of the subnet segment where the IP address corresponding to the start address is located is determined, and the mask length is the number of bits of the network number in the set of IP addresses representing the same network number in the mask. The subnet segments to be divided are determined based on the IP address corresponding to the starting address and the mask length; When the end address of the determined subnet segment is the end address of the preset IP address set, the set of subnet segments is determined as the target IP network segment.

7. The apparatus according to claim 6, characterized in that, The device further includes: The address update unit is used to determine that when the intermediate end address exceeds the end address of the binary address set, if the mask length is greater than 0, to decrement N by one, and update the intermediate end address according to the start address of the subnet segment to be divided and the updated value of N. The updated intermediate end address is the binary address after replacing the N consecutive 0s with 1s from the end to the high-order bits of the start address of the subnet segment to be divided.

8. The apparatus according to claim 6, characterized in that, The sub-network segment division unit is also used for: When the starting address of the subnet to be divided is not 0 at the end, the IP address corresponding to the starting address of the subnet to be divided is determined as a subnet with only one IP address. The address following the starting address of the subnet segment to be divided is determined as the new starting address of the subnet segment to be divided.

9. The apparatus according to claim 6, characterized in that, The sub-network segment division unit is also used for: When the starting address of the subnet segment to be divided is the ending address of the binary address set, the IP address corresponding to the starting address of the subnet segment to be divided is determined as a subnet segment with only one IP address. The set of all subnets is determined as the target IP network segment.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images