Access method, device and system for enterprise network

Abstract

The present application relates to the field of enterprise network technology, and discloses an access method for an enterprise network, including: marking an access data packet sent by a client with a virtual extensible local area network (VXLAN) tag through a regional network aggregation center switch, and forwarding the access data packet to a data center switch according to a VXLAN network access policy; sending an access data packet carrying a VXLAN tag to a zero-trust main server through a data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client. The enterprise network is constructed as a three-level leaf-spine network topology, and the VXLAN tag is introduced as an identification factor for the identity access of a client located at a member unit node, which can significantly reduce the risk of the enterprise network and improve the security of the enterprise network. The present application also discloses an access device and system for an enterprise network.

Description

Technical Field

[0001] The present application relates to the field of enterprise network technology, for example, to a method, device and system for accessing an enterprise network. Background Art

[0002] With the development of high-speed Internet, the interconnection of everything and IT cloudification have become the current trend of network development. The traditional networking mode of enterprises adopts the dedicated line networking mode, which cannot adapt well to the high-speed development environment of the Internet. In related technologies, SDN (Software-Define WAN) technology is applied to the wide area network scenario, a central control server is deployed on the enterprise's local area network, and the central control server is interconnected with multiple devices of the enterprise, providing a controllable enterprise network for the enterprise, which is convenient for the enterprise to uniformly manage network devices.

[0003] In the process of implementing the embodiments of the present disclosure, it is found that there are at least the following problems in the related art:

[0004] Currently, SD WAN is applied to enterprise networking construction to interconnect network devices used within the enterprise and to interconnect the enterprise's external network with the internal network, increasing the enterprise's network security risks.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0007] The embodiments of the present disclosure provide a method, device and system for accessing an enterprise network to reduce the risk of the enterprise network and improve the security of the enterprise network.

[0008] In some embodiments, an access method for an enterprise network is provided, in which the network hierarchy of the enterprise network is divided in sequence according to data center nodes, regional network aggregation center nodes and member unit nodes, and nodes at each level are connected in sequence according to the SD-WAN method; a data center switch and a zero-trust main server are deployed at the data center node, and a regional network aggregation center switch and a zero-trust gateway for communication connection with the zero-trust server are deployed at the regional network aggregation center node; the access method includes: adding a virtual extensible local area network VXLAN tag to an access data packet sent by the client through the regional network aggregation center switch, and forwarding the access data packet to the data center switch according to the VXLAN network access policy; sending an access data packet carrying the VXLAN tag to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client.

[0009] In some embodiments, the access device for an enterprise network includes a processor and a memory storing program instructions, and the processor is configured to execute the aforementioned access method for an enterprise network when running the program instructions.

[0010] In some embodiments, an access system for an enterprise network includes a data center node, a regional network aggregation center node, a member unit node, and the aforementioned access device for the enterprise network, wherein: the data center node deploys a zero-trust main server and a data center switch; the regional network aggregation center node deploys a zero-trust gateway and a regional network aggregation center switch.

[0011] The access method, device and system for an enterprise network provided by the embodiments of the present disclosure can achieve the following technical effects:

[0012] In the disclosed technical solution, the network level of the enterprise network is divided in order according to the data center node, the regional network convergence center node and the member unit node, and the nodes at each level are connected in sequence according to the SD-WAN method. At the same time, the data center switch and the zero-trust main server are deployed in the data center node, and the regional network convergence center switch and the zero-trust gateway for communication connection with the zero-trust server are deployed in the regional network convergence center node. First, the access data packet sent by the client is marked with a virtual extensible local area network VXLAN tag through the regional network convergence center switch, and then the access data packet carrying the VXLAN tag is sent to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client.

[0013] In this way, the enterprise network is constructed as a three-level leaf-spine network topology structure with data center nodes, regional network aggregation center nodes and member unit nodes, and VXLAN tags are introduced as identification factors for client identity access at member unit nodes. Combined with the authentication mechanism of the zero-trust system, the expansion of enterprise network access control authentication elements can be realized, which can significantly reduce the risks of enterprise networks and improve the security of enterprise networks. At the same time, after the data center nodes and member unit nodes are interconnected through the regional network aggregation center nodes, the data transmission channels of the enterprise network are increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network.

[0014] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0016] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0017] Figure 1 is a schematic diagram of a network topology structure of an enterprise network provided by an embodiment of the present disclosure;

[0018] Figure 2 is a schematic diagram of the structure of an enterprise network provided by an embodiment of the present disclosure;

[0019] Figure 3 is a schematic diagram of the structure of another enterprise network provided by an embodiment of the present disclosure;

[0020] Figure 4 It is a flowchart of a networking method for an enterprise network provided by an embodiment of the present disclosure;

[0021] Figure 5 is a flowchart of another networking method for an enterprise network provided by an embodiment of the present disclosure;

[0022] Figure 6 is a flow chart of another networking method for an enterprise network provided by an embodiment of the present disclosure;

[0023] Figure 7 It is a flowchart of a method for accessing an enterprise network provided by an embodiment of the present disclosure;

[0024] Figure 8 is a flowchart of another method for accessing an enterprise network provided by an embodiment of the present disclosure;

[0025] Fig. 9 is a flowchart of another method for accessing an enterprise network provided by an embodiment of the present disclosure;

[0026] Fig.10 It is a structural diagram of an access device for an enterprise network provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0028] The terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0029] Unless otherwise specified, the term "plurality" means two or more than two. In the disclosed embodiment, the character " / " indicates that the objects before and after are in an "or" relationship. For example, A / B means: A or B. The term "and / or" is a description of the association relationship between objects, indicating that three relationships may exist. For example, A and / or B means: A or B, or, the three relationships of A and B. The term "corresponding" may refer to an association relationship or a binding relationship, and the correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0030] In view of the obvious cross-regional characteristics of large enterprises, the present invention provides a multi-space large-scale remote networking solution in the enterprise network networking link, so that the flexibility and confidentiality of the network can meet the requirements of large enterprises.

[0031] The key technical terms in the embodiments of the present disclosure are explained below:

[0032] Data center nodes are data centers composed of multiple groups of cloud controllers, which can realize centralized management and control of bandwidth resources and rapid scheduling of routes, making data transmission services more stable and reliable. Data center nodes build SDN networks that divide data planes by business and manage cross-regional regional network center traffic. Among them, the SDN network establishes direct links between remote data centers on the enterprise network framework of SDN-WAN to achieve rapid scheduling.

[0033] The regional network aggregation center node is responsible for the communication traffic within and between member unit nodes, and manages the network address division of access member units. At the same time, the regional network aggregation center node is the public network boundary exit of the SD-WAN bearer network, which is used to realize the regional network aggregation and access traffic diversion of member unit nodes.

[0034] Member unit nodes are responsible for accessing the enterprise network to the device terminals in the member unit nodes, such as member unit workplaces, edge computing power rooms, industrial control IoT rooms, and public cloud resources.

[0035] SD-WAN (Software-Defined WAN) is a network management method that uses mature software technologies (such as intelligent routing scheduling, application optimization, transmission control protocol TCP optimization, quality of service QOS, etc.) to highly integrate traditional network resources (such as the Internet, narrowband dedicated lines, multi-protocol label switching MPLS, long-term evolution LTE, bare fiber, etc.) with other resources to maximize the performance of traditional resources.

[0036] SDN (Software Defined Networking) is a new type of network architecture and a way to implement network virtualization. It uses application software to control and manage the network, meet upper-layer business needs, and simplify network operation and maintenance through automated business deployment.

[0037] CPE (Customer-premises equipment) is a network terminal device located at the user end or branch office. It is used to connect with operators and is an important part of network solutions.

[0038] VXLAN (Virtual eXtensible Local Area Network) is a network virtualization technology and an extension of the virtual local area network VLAN. It adopts the L2over L4 (MAC-in-UDP) message encapsulation mode to encapsulate the Layer 2 message with the Layer 3 message, which can realize the expansion of the Layer 2 network within the Layer 3 range and meet the needs of large Layer 2 virtual migration and multi-tenancy in the data center.

[0039] Combination Figure 1 As shown, an embodiment of the present disclosure provides a network topology structure of an enterprise network, including data center nodes, regional network aggregation center nodes and member unit nodes, and relies on SD-WAN technology to connect nodes at all levels to complete preliminary remote networking.

[0040] The enterprise network of the disclosed embodiment adopts a leaf-spine network topology structure, where data center nodes correspond to spine nodes, regional network aggregation center nodes correspond to leaf nodes, and member unit nodes correspond to edge nodes.

[0041] In actual applications, data center nodes collect the status of regional network aggregation center nodes and links, perceive and adjust network resource allocation. Data center nodes are directly connected through the SDN network to achieve rapid information sharing. As the point of entry (POP) node of the enterprise network, the regional network center node is responsible for the communication between member unit nodes. It needs to report its own status information to the data center node and accept the scheduling of the data center node to ensure the service quality (QoS) of the member unit nodes. The member unit nodes are connected to the regional network aggregation center node nearby.

[0042] In the present disclosure, in combination Figure 2 As shown in the figure, when building an enterprise network, the network level of the enterprise network is divided into data center nodes, regional network aggregation center nodes, and member unit nodes in sequence, and nodes at each level are connected in sequence according to the SD-WAN method. Data center CPE devices are deployed at data center nodes, regional network aggregation center CPE devices are deployed at regional network aggregation center nodes, and member unit CPE devices are deployed at member unit nodes. SDN controllers and data center switches are deployed at data center nodes, and regional network aggregation center switches are deployed at regional network aggregation nodes.

[0043] Deploy data center CPE devices at data center nodes, deploy regional network convergence center CPE devices at regional network convergence center nodes, and deploy member unit CPE devices at member unit nodes. The enterprise network office terminals at member unit nodes enter the enterprise intranet SD-WAN network through the member unit CPE devices and are assigned to the nearest regional network convergence center node. After verification by the zero-trust system of the enterprise network and following the DNS scheduling of the domain name system, office terminals located at the enterprise network member unit nodes can access external websites through the regional network convergence center CPE devices from the public network exit of the regional network convergence center node, without the need to converge upward to the main data center, thereby sharing the traffic pressure of the main data center. At the same time, office terminals located at the enterprise network member unit nodes can also enter the enterprise intranet SD-WAN network through the member unit CPE devices, and access the data center node via the enterprise intranet SDN routing distribution uplink.

[0044] After building the enterprise network in the above manner, network interconnection between data center nodes and member unit nodes is achieved, which can greatly reduce the need for each information site to maintain network policies, improve the work efficiency of the enterprise network, and reduce the problem of policy overflow.

[0045] In some embodiments, in combination Figure 3 As shown, the network hierarchy of the enterprise network is divided into data center nodes, regional network aggregation center nodes and member unit nodes in sequence, and the nodes at each level are connected in sequence according to the SD-WAN method; data center switches and zero-trust main servers are deployed in data center nodes, and regional network aggregation center switches and zero-trust gateways that communicate with zero-trust servers are deployed in regional network aggregation center nodes.

[0046] By deploying zero-trust master servers and zero-trust gateways in enterprise networks and introducing zero-trust access control in SD-WAN and SDN networking technologies, network security can be improved from the perspective of access control. Among them, zero trust (ZTA) means continuous verification and dynamic authorization of users based on trust factors such as access subject identity, network environment, and terminal status.

[0047] The enterprise network provided by the embodiment of the present disclosure combines SD-WAN and SDN technologies to support the device terminals of each member unit to access their own network plane without IP address modification, and provide users with real-time and dynamic switching capabilities of network links without perception to avoid business interruption. At the same time, based on the network front-end access CPE equipment, VXLAN technology is integrated, and a zero-trust access authentication architecture is integrated to form an active security defense capability of the enterprise network in the network system, thereby improving the security of the enterprise network.

[0048] In some embodiments, in combination Figure 4As shown, a networking method for an enterprise network is provided, comprising the following steps:

[0049] S401, divide the network level of the enterprise network according to the data center node, regional network aggregation center node and member unit node in sequence, and connect the nodes at each level in sequence according to the SD-WAN method.

[0050] S402, deploying a data center CPE device at a data center node, deploying a regional network convergence center CPE device at a regional network convergence center node, and deploying a member unit CPE device at a member unit node.

[0051] Among them, the data center CPE device, the regional network convergence center CPE device and the member unit CPE device are networked through the binding code, and the member unit CPE device is configured to forward the data information sent by the client to the regional network convergence center CPE device.

[0052] Here, the binding code can be the unique device identification of each CPE device. For example, the data center CPE device requests the SDN controller of the data center node to complete authentication through the device identification of the data center CPE device, and then reads the network configuration information from the SDN controller to complete basic networking. The regional network convergence center CPE device requests the SDN controller of the data center node to complete authentication through the device identification of the regional network convergence center CPE device, and then reads the network configuration information from the SDN controller to complete basic networking. The member unit CPE device requests the SDN controller of the data center node to complete authentication through the device identification of the member unit CPE device, and then reads the network configuration information from the SDN controller to complete basic networking.

[0053] In some practical applications, the CPE equipment of member units can also be deployed on the terminal equipment of member unit nodes, and the vCPE program can be installed on the terminal equipment. After identity authentication, the enterprise network can be accessed. The vCPE program supports multiple operating systems such as Windows, Linux, Mac OS, and Android. This is conducive to the smooth access of mobile terminals to the enterprise network for the needs of enterprise remote office and dynamic access, and can access the enterprise network anytime and anywhere, realizing seamless access for remote office.

[0054] In one possible implementation, the CPE device of the member unit is configured as follows: the IP address of the service access request information sent by the client is converted into a target IP address; based on the target IP address, the converted service access request information is forwarded to the CPE device of the target area network aggregation center through the SD-WAN encrypted channel.

[0055] Here, the service access request information includes one or more of extranet service access request information for accessing extranet service applications, data center service access request information for accessing data center service applications, and member unit service access request information for accessing member unit service applications.

[0056] The member unit CPE device stores the IP address configuration table of the service access request information and the corresponding target IP address uniformly planned by the enterprise network. Based on the IP address of the service access request information sent by the client, the network address is converted into the unified target IP address of the enterprise network, so as to quickly determine the forwarding target and realize the fast and accurate forwarding operation of the service access request information. At the same time, the SD-WAN encrypted channel is used to forward the service access request information, which improves the security performance of the enterprise network communication.

[0057] In some possible implementations, the SD-WAN encrypted channel is determined based on the target IP address. The business application type corresponding to the business access request information is determined based on the target IP address, and the target SD-WAN encrypted channel is determined based on the business application type. Different IP addresses generally correspond to different types of business applications, so the business application type corresponding to the business access request information can be determined based on the target IP address. For example, for business application types with high confidentiality requirements, an SD-WAN encrypted channel with a high encryption level is selected as the target SD-WAN encrypted channel. Alternatively, for business application types with a large number level, an SD-WAN encrypted channel with a faster transmission rate is selected as the target SD-WAN encrypted channel. Thereby, the security and work efficiency of enterprise network communications are improved.

[0058] Optionally, the target regional network convergence center CPE device is determined in the following manner: multiple regional network convergence center CPE devices located within a preset geographical range centered on the current member unit CPE device are determined; data transmission efficiency of the multiple regional network convergence center CPE devices is determined; wherein the data transmission efficiency characterizes the data transmission speed and transmission accuracy of the regional network convergence center CPE device in the current state; based on the data transmission efficiency, a regional network convergence center CPE device is selected from multiple regional network convergence center CPE devices as the target regional network convergence center CPE device.

[0059] Here, the preset geographical range can be a preset distance range centered on the current member unit CPE device (for example, a radius of 100 meters centered on the current member unit CPE device), or a preset building range centered on the current member unit CPE device (for example, 10 buildings around the current member unit CPE device).

[0060] In actual applications, the data transmission efficiency of the CPE device in the regional network aggregation center is calculated according to the following formula:

[0061] E=α×S+β×A

[0062] Among them, E is the data transmission efficiency, S is the data transmission speed level, A is the transmission accuracy level, α is the weight coefficient of the quantity level of business access request information, β is the weight coefficient of the business application security level corresponding to the target IP address, and α+β=1.

[0063] The weight coefficient α of the quantity level of the business access request information is positively correlated with the quantity level of the business access request information. The larger the quantity level of the business access request information, the larger α is, and the smaller the quantity level of the business access request information, the smaller α is. The weight coefficient β of the business application security level corresponding to the target IP address is positively correlated with the business application security level corresponding to the target IP address. The larger the business application security level corresponding to the target IP address, the larger β is. The smaller the business application security level corresponding to the target IP address, the smaller β is.

[0064] In practical applications, the regional network convergence center CPE device with the highest data transmission efficiency can be selected from multiple regional network convergence center CPE devices as the target regional network convergence center CPE device

[0065] Determine multiple regional network convergence center CPE devices located within a preset geographical range centered on the current member unit CPE device, and select a regional network convergence center CPE device from multiple regional network convergence center CPE devices as the target regional network convergence center CPE device according to the data transmission efficiency of each regional network convergence center CPE device. In this way, on the one hand, the smoothness and communication capability of the connection between the member unit CPE device and the target regional network convergence center CPE device are improved, and on the other hand, the data transmission efficiency of the regional network convergence center CPE device is determined according to the number level of business access request information and the security level of business applications, which can improve the data transmission efficiency and security performance of the enterprise network.

[0066] S403, deploying an SDN controller and a data center switch at a data center node, and deploying a regional network aggregation center switch at a regional network aggregation node.

[0067] Among them, the SDN controller is configured to send configuration information to the regional network aggregation center switch and the data center switch, the regional network aggregation center switch is configured to forward the data information sent by the regional network aggregation center CPE device to the data center CPE device according to the configuration information, and the data center switch is configured to forward the data information sent by the regional network aggregation center CPE device to the target application server according to the configuration information.

[0068] Here, the configuration information may be the forwarding routes and / or forwarding links of the regional network aggregation center switch and the data center switch. The forwarding route may be the forwarding path from the current device to the final target device; the forwarding link may be the communication tunnel used under the same forwarding path.

[0069] Using the enterprise network established by the embodiment of the present disclosure, the terminal devices of the member unit nodes can access public network traffic. Specifically, the terminal devices of the member unit nodes access the SD-WAN intranet of the enterprise network through the member unit CPE device, and are assigned to the regional network aggregation center node with the closest geographical location. Then, using the regional network aggregation center CPE device, access the public network through the public network exit of the regional network aggregation center node to access external websites or public cloud destination addresses, without the need to converge upward to the data center node, thereby sharing the traffic pressure of the data center node.

[0070] Using the enterprise network established by the embodiment of the present disclosure, the terminal devices of the member unit nodes can access the business applications of the data center nodes. Specifically, the terminal devices of the member unit nodes access the SD-WAN intranet of the enterprise network through the member unit CPE devices, and are assigned to the regional network aggregation center node that is geographically closest. Then, the regional network aggregation center CPE device is used to send data request information for accessing business applications and the address information of the terminal device to the regional network aggregation center switch, and the data request information and address information are forwarded through the regional network aggregation center switch. After the data center CPE device receives and sends the data request information and address information to the data center switch, the data center switch forwards the data request information and the address information of the terminal device to the application server. Finally, the application server responds according to the data request information, and feeds back the response result to the terminal device according to the address information of the terminal device.

[0071] In a possible implementation, the SDN controller is configured as follows: obtaining an abnormal condition of a first regional network convergence center node; when an abnormality occurs in the first regional network convergence center node, switching the link of the first regional network convergence center node to a second regional network convergence center node.

[0072] In actual applications, when the node operation status of the first regional network aggregation center node is abnormal (for example, the failure rate is greater than the preset failure rate, the congestion rate is greater than the preset congestion rate and / or the network jitter amplitude is greater than the preset network jitter amplitude), it is confirmed that the first regional network aggregation center node is abnormal.

[0073] The SDN controller can intelligently select different link types for transmission based on the link latency and reliability requirements of different applications, giving priority to core business. When an abnormality occurs in the first regional network convergence center node, the communication link of the first regional network convergence center node is switched to the second regional network convergence center node, achieving seamless switching and ensuring high availability of the entire enterprise network.

[0074] Optionally, the second regional network convergence center node is determined in the following manner: multiple regional network convergence center nodes associated with the first regional network convergence center node are obtained; the node operation status of the multiple regional network convergence center nodes is determined; wherein the node operation status includes one or more of a failure rate, a congestion rate, and a network jitter amplitude; based on the node operation status, a regional network convergence center node is selected from the multiple regional network convergence center nodes as the second regional network convergence center node.

[0075] The multiple regional network convergence center nodes associated with the first regional network convergence center node may be regional network convergence center nodes that are geographically close to the first regional network convergence center node, or may be regional network convergence center nodes that are in the same administrative region (e.g., the same city, district / county) as the first regional network convergence center node.

[0076] The failure rate of the regional network convergence center node is the probability of a data transmission failure occurring in the regional network convergence center node in a preset time period. For example, it may be the probability of a data transmission failure occurring in the regional network convergence center CPE device in a preset time period (e.g., the previous month), or the probability of a data transmission failure occurring in the regional network convergence center switch in a preset time period, or the total probability of a data transmission failure occurring in the regional network convergence center CPE device and the regional network convergence center switch in a preset time period.

[0077] The congestion rate of the regional network convergence center node is the number of data packets that the regional network convergence center node needs to transmit in a preset time period (including the number of transmitted data packets and the number of queued data packets). For example, it can be the number of data packets that the regional network convergence center CPE device needs to transmit in a preset time period (for example, the first 5 minutes), or it can be the number of data packets that the regional network convergence center switch needs to transmit in a preset time period, or it can be the total number of data packets that the regional network convergence center CPE device and the regional network convergence center switch need to transmit in a preset time period.

[0078] The network jitter amplitude of the regional network convergence center node is the maximum network jitter amplitude that occurs during the data transmission process of the regional network convergence center node in a preset time period. For example, it can be the maximum network jitter amplitude that occurs during the data transmission process of the regional network convergence center CPE device in a preset time period (for example, the previous 1 hour), or it can be the maximum network jitter amplitude that occurs during the data transmission process of the regional network convergence center switch in a preset time period, or it can be the maximum network jitter amplitude that occurs during the data transmission process of the regional network convergence center CPE device and the regional network convergence center switch in a preset time period. The maximum network jitter amplitude that occurs during data transmission can be determined by detecting the maximum delay time of the regional network convergence center node when network congestion occurs.

[0079] Based on the node operation status of the regional network convergence center node, a regional network convergence center node with the best node operation status (for example, the smallest failure rate, the smallest congestion rate and / or the smallest network jitter amplitude) is selected from multiple regional network convergence center nodes as the second regional network convergence center node. In this way, the communication link of the first regional network convergence center node with a poor node operation status is switched to the second regional network convergence center node in a timely manner, which can improve the smoothness and communication capability of the enterprise network communication.

[0080] In one possible implementation, the regional network aggregation center switch is configured as follows: based on the IP address information of the service access request information, a virtual extensible local area network VXLAN tag is added to the service access request information; the access control policy is matched through the VXLAN tag; and the service access request information is forwarded to the data center CPE device according to the access control policy.

[0081] Faced with a large number of network devices in the member unit nodes, VXLAN technology is used to divide the terminals, devices, applications, etc. involved in the networking into corresponding virtual network segments based on the IP address information of the service access request information. The introduction of VXLAN can well solve the problem of the source and flow of user data traffic in access control. VXLAN can be used to build an independent virtual overlay network, which can quickly form a network without IP planning and transformation. It can support up to 16M VXLAN segments, and can perform detailed division of traffic from different sources and different services in the enterprise network, which can meet the organizational management needs of large enterprises.

[0082] Optionally, forwarding service access request information to the data center CPE device according to the access control policy, including: determining the request source of the service access request information and the target source of the access control policy; when the request source of the service access request information and the target source of the access control policy are in the same data plane, forwarding the service access request information to the data center CPE device; when the request source of the service access request information and the target source of the access control policy are in different data planes, stopping forwarding the service access request information to the data center CPE device.

[0083] The request source of the business access request information is the enterprise network node that stores the target business application in the business access request information. For example, if the target business application in the business access request information is a business application of public network traffic or a member unit node, the corresponding enterprise network node is the regional network aggregation center node; if the target business application in the business access request information is a business application of a data center node, the corresponding enterprise network node is the data center node.

[0084] The target source of the access control policy is the target enterprise network forwarding node (eg, data center node) in the access control policy of the regional network aggregation center switch.

[0085] When the request source of the service access request information and the target source of the access control policy are in the same data plane (for example, they are both data center nodes), the regional network convergence center switch forwards the service access request information to the data center CPE device, while when the request source of the service access request information and the target source of the access control policy are in different data planes (for example, the request source of the service access request information is the regional network convergence center node, and the target source of the access control policy is the data center node), the regional network convergence center switch stops forwarding the service access request information to the data center CPE device. In this way, the service access request information is screened in advance, and the service access request information that does not need to be processed by the data center node is truncated at the lower edge enterprise network node (for example, the regional network convergence center node), and no longer needs to be converged upward to the data center node, thereby sharing the traffic pressure of the data center node.

[0086] By adopting the networking method for enterprise network provided by the embodiment of the present disclosure, the network hierarchy of the enterprise network is divided in sequence according to the data center node, the regional network aggregation center node and the member unit node, and the nodes at each level are connected in sequence according to the SD-WAN method. At the same time, the data center CPE device is deployed in the data center node, the regional network aggregation center CPE device is deployed in the regional network aggregation center node, the member unit CPE device is deployed in the member unit node, and the SDN controller and data center switch are deployed in the data center node, and the regional network aggregation center switch is deployed in the regional network aggregation node, so as to complete the establishment of the enterprise network.

[0087] In this way, the enterprise network is constructed as a three-level leaf-spine network topology structure with data center nodes, regional network aggregation center nodes and member unit nodes, and CPE devices are deployed at the network boundary of each enterprise network node. After the data center nodes and member unit nodes are interconnected through the regional network aggregation center nodes and each CPE device, the data transmission channel of the enterprise network is increased, which can significantly alleviate the congestion of the enterprise network and increase the data transmission rate of the enterprise network. At the same time, it can greatly reduce the need for each information site to maintain network access policies, improve work efficiency, and reduce the occurrence of policy overflow problems.

[0088] Combination Figure 5 As shown, in some embodiments, a networking method for an enterprise network is provided, comprising the following steps:

[0089] S501, divide the network level of the enterprise network according to the data center node, regional network aggregation center node and member unit node in sequence, and connect the nodes at each level in sequence according to the SD-WAN method.

[0090] S502, deploying a data center CPE device at a data center node, deploying a regional network convergence center CPE device at a regional network convergence center node, and deploying a member unit CPE device at a member unit node.

[0091] S503, deploy an SDN controller and a data center switch at a data center node, and deploy a regional network aggregation center switch at a regional network aggregation node.

[0092] S504, deploy a zero-trust main server at the data center node, and deploy a zero-trust gateway at the regional network aggregation center node; wherein the zero-trust main server is connected to the zero-trust gateway for communication.

[0093] S505, verify the access data packet sent by the client through the zero trust server and notify the zero trust gateway to establish a communication tunnel with the client based on the verification result.

[0094] In the disclosed embodiment, the enterprise network is constructed as a three-level leaf-spine network topology structure of data center nodes, regional network convergence center nodes, and member unit nodes, and CPE devices are deployed at the network boundaries of each enterprise network node. After the data center nodes and member unit nodes are interconnected through the regional network convergence center node and each CPE device, the data transmission channel of the enterprise network is increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network. At the same time, the VXLAN tag is introduced as an identification factor for the identity access of the client located at the member unit node, combined with the authentication mechanism of the zero-trust system to achieve the expansion of the enterprise network access control authentication elements, which can significantly reduce the risk of the enterprise network and improve the security of the enterprise network.

[0095] Combination Figure 6 As shown, in some embodiments, a networking method for an enterprise network is provided, comprising the following steps:

[0096] S601, the SDN controller sends configuration information to the data center switch.

[0097] S602, the SDN controller sends configuration information to the regional network aggregation center switch.

[0098] S603: The client sends a service access request message to the member unit CPE device.

[0099] S604: The member unit CPE device converts the IP address of the service access request information sent by the client into a target IP address.

[0100] S605, the member unit CPE device forwards the converted service access request information to the target area network aggregation center CPE device through the SD-WAN encrypted channel based on the target IP address.

[0101] S606: The regional network convergence center CPE device sends service access request information to the regional network convergence center switch.

[0102] S607, the regional network aggregation center switch adds a virtual extensible local area network VXLAN tag to the service access request information according to the IP address information of the service access request information.

[0103] S608, the regional network aggregation center switch matches the access control policy through the VXLAN label.

[0104] S609: The regional network aggregation center switch forwards the service access request information to the data center CPE device according to the access control policy.

[0105] S610: The data center CPE device sends service access request information to the data center switch.

[0106] S611, the data center switch sends service access request information to the application server.

[0107] S612: The application server responds to the service access request information and sends a response result to the client.

[0108] In the disclosed embodiment, the enterprise network is constructed as a three-level leaf-spine network topology structure of data center nodes, regional network convergence center nodes, and member unit nodes, and CPE devices are deployed at the network boundaries of each enterprise network node. After the data center nodes and member unit nodes are interconnected through the regional network convergence center nodes and each CPE device, the data transmission channel of the enterprise network is increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network. At the same time, combined with SD-WAN and SDN technologies, it supports the device terminals of each member unit to access their respective network planes without IP address modification, and provides users with real-time and dynamic switching capabilities of imperceptible network links to avoid business interruptions. In addition, based on the network front-end access CPE device, VXLAN technology is integrated, and a zero-trust access authentication architecture is integrated to form an active security defense capability of the enterprise network in the network system, thereby improving the security of the enterprise network.

[0109] As mentioned above, the network hierarchy of the enterprise network is divided into data center nodes, regional network aggregation center nodes and member unit nodes in sequence, and nodes at all levels are connected in sequence according to the SD-WAN method. Data center switches and zero-trust main servers are deployed in data center nodes, and regional network aggregation center switches and zero-trust gateways that communicate with zero-trust servers are deployed in regional network aggregation center nodes.

[0110] The enterprise network is formed in the following manner: the network levels of the enterprise network are divided in order according to data center nodes, regional network convergence center nodes and member unit nodes, and nodes at each level are connected in sequence according to the SD-WAN method; data center CPE devices are deployed at data center nodes, regional network convergence center CPE devices are deployed at regional network convergence center nodes, and member unit CPE devices are deployed at member unit nodes, wherein the data center CPE devices, regional network convergence center CPE devices and member unit CPE devices are networked through binding codes, and the member unit CPE devices are configured to forward data information sent by the client to the regional network convergence center CPE devices; SDN controllers and data center switches are deployed at data center nodes, and regional network convergence center switches are deployed at regional network convergence nodes, wherein the SDN controllers are configured to send configuration information to the regional network convergence center switches and data center switches, the regional network convergence center switches are configured to forward data information sent by the regional network convergence center CPE devices to the data center CPE devices according to the configuration information, and the data center switches are configured to forward data information sent by the regional network convergence center CPE devices to the target application servers according to the configuration information.

[0111] In some embodiments, in combination Figure 7As shown, based on the aforementioned enterprise network, a method for accessing the enterprise network is provided, comprising the following steps:

[0112] S701, add a virtual extensible local area network VXLAN tag to the access data packet sent by the client through the regional network aggregation center switch, and forward the access data packet to the data center switch according to the VXLAN network access policy.

[0113] The VXLAN protocol encapsulates the original data packet and encapsulates the VXLAN tag content into a data packet and adds it as the header of the new access data packet. VXLAN tags can be predefined, and access data packets with different VXLAN tags can form different data planes to achieve mutual isolation. In addition, the VXLAN tag has 8 bytes, and 24 bits are used to identify different Layer 2 networks. In this way, there are more than 16 million 16M VXLAN segments in total, which can fully meet the requirements of data plane division in complex network environments.

[0114] S702, sending an access data packet carrying a VXLAN tag to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client.

[0115] By utilizing the enterprise network established by the embodiments of the present disclosure, the terminal devices of the member unit nodes can realize the interconnection of the business applications of the member unit nodes. Specifically, the terminal devices of the member unit nodes access the SD-WAN intranet of the enterprise network through the member unit CPE devices, and are assigned to the regional network aggregation center node that is geographically closest. Then, after verification by the zero-trust gateway, the zero-trust gateway establishes a secure communication tunnel with the terminal device, and the zero-trust gateway sends the access routes of other regional network aggregation center nodes to the terminal device. The terminal device accesses other regional network aggregation center nodes (the regional network aggregation center nodes are connected to the member unit nodes) through the access routes, thereby accessing the member unit business applications and realizing the interconnection of the business applications of the member unit nodes.

[0116] The zero-trust gateway establishes a transport layer security protocol TLS communication tunnel with the client (terminal device / office terminal). The access traffic of the data plane no longer needs to detour to the data center node. The interaction path is shorter and the communication efficiency is higher. It can also achieve dynamic traffic control capabilities by adjusting the access route of the link in real time.

[0117] In some possible embodiments, the zero-trust gateway is configured as follows: upon receiving a verification success notification message sent by a zero-trust primary server, a session token is generated; and a communication tunnel is established between the zero-trust gateway and the client based on the session token.

[0118] The session token is an identity authentication ticket. The zero-trust gateway will verify the session token. If the verification is successful, it proves that the client is legitimate, and a trusted communication tunnel will be established with the zero-trust client. Otherwise, the client is deemed to be illegitimate and the communication tunnel will not be established. In this way, the risk of the enterprise network can be reduced and the security of the enterprise network can be improved.

[0119] In some possible embodiments, the zero-trust master server is configured as follows: the VXLAN ID tag of the access data packet is determined, and identity authentication is performed through the VXLAN ID tag; after the identity authentication is passed, a verification success notification message is sent to the zero-trust gateway.

[0120] The VXLAN ID tag is unique and forms a unique correspondence with each member unit node. This correspondence is preset in the zero-trust master server. The business access rights can be configured as the primary key according to actual business needs, so that when there is an access request data packet, the VXLAN ID tag is used as a label for zero-trust gateway identity identification.

[0121] Introducing zero-trust access control in enterprise networks expands the access control model in enterprise networks, uses the VXLAN ID tag in SDN technology as a factor for identity access authentication, and combines the authentication mechanism of the zero-trust system to achieve the expansion of network access control authentication elements. In this way, both the control of user sources and user identities is achieved, making network access control more secure.

[0122] Using the access method for enterprise network provided by the embodiment of the present disclosure, the network hierarchy of the enterprise network is divided in order according to the data center node, the regional network convergence center node and the member unit node, and the nodes at each level are connected in sequence according to the SD-WAN method. At the same time, the data center switch and the zero-trust main server are deployed in the data center node, and the regional network convergence center switch and the zero-trust gateway for communication connection with the zero-trust server are deployed in the regional network convergence center node. First, the access data packet sent by the client is marked with a virtual extensible local area network VXLAN tag through the regional network convergence center switch, and then the access data packet carrying the VXLAN tag is sent to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client.

[0123] In this way, the enterprise network is constructed as a three-level leaf-spine network topology structure with data center nodes, regional network aggregation center nodes and member unit nodes, and VXLAN tags are introduced as identification factors for client identity access at member unit nodes. Combined with the authentication mechanism of the zero-trust system, the expansion of enterprise network access control authentication elements can be realized, which can significantly reduce the risks of enterprise networks and improve the security of enterprise networks. At the same time, after the data center nodes and member unit nodes are interconnected through the regional network aggregation center nodes, the data transmission channels of the enterprise network are increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network.

[0124] Combination Figure 8 As shown, in some embodiments, a method for accessing an enterprise network is provided, comprising the following steps:

[0125] S801, add a virtual extensible local area network VXLAN tag to the access data packet sent by the client through the regional network aggregation center switch, and forward the access data packet to the data center switch according to the VXLAN network access policy.

[0126] S802, sending an access data packet carrying a VXLAN tag to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packet and notifies the zero-trust gateway to establish a communication tunnel with the client.

[0127] S803, after the zero-trust gateway establishes a communication tunnel with the client, the access data packet sent by the client is marked with a VXLAN tag through the regional network aggregation center switch.

[0128] S804, the regional network aggregation center switch forwards the access data packet to the zero-trust gateway according to the VXLAN network access policy.

[0129] S805, sending an access data packet forwarded by the zero-trust gateway to the application server through the data center switch, so that the application server responds to the access data packet and sends a response result to the client.

[0130] In some practical applications, after the zero-trust gateway establishes a communication tunnel with the client, the access data packet sent by the client is marked with a VXLAN tag through the regional network aggregation center switch. The regional network aggregation center switch forwards the access data packet to the zero-trust gateway according to the VXLAN network access policy. The zero-trust gateway sends the access data packet to the zero-trust server through the TLS communication tunnel between the zero-trust gateway and the zero-trust server. The zero-trust server forwards the access data packet to the application server, so that the application server responds to the access data packet and sends the response result to the client.

[0131] In some practical applications, after the zero-trust gateway establishes a communication tunnel with the client, the access data packet sent by the client is marked with a VXLAN tag through the regional network aggregation center switch. The regional network aggregation center switch forwards the access data packet to the client according to the VXLAN network access policy. The client sends the access data packet to the zero-trust gateway through the communication tunnel between the zero-trust gateway and the client. The zero-trust gateway sends the access data packet to the zero-trust server through the communication tunnel between the zero-trust gateway and the zero-trust server. The zero-trust server forwards the access data packet to the application server, so that the application server responds to the access data packet and sends the response result to the client.

[0132] After the zero-trust gateway establishes a communication tunnel with the client, the access traffic of the data plane no longer needs to go around the data center node, the interaction path is shorter, the communication efficiency is higher, and the access route of the link can be adjusted in real time to achieve dynamic traffic control capabilities.

[0133] In the disclosed embodiment, the enterprise network is constructed as a three-level leaf-spine network topology structure of data center nodes, regional network aggregation center nodes and member unit nodes, and VXLAN tags are introduced as identification factors for client identity access at member unit nodes. The authentication mechanism of the zero-trust system is combined to realize the expansion of the enterprise network access control authentication elements, which can significantly reduce the risks of the enterprise network and improve the security of the enterprise network. At the same time, after the data center nodes and member unit nodes are interconnected through the regional network aggregation center node, the data transmission channel of the enterprise network is increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network.

[0134] Combination Fig. 9 As shown, in some embodiments, a method for accessing an enterprise network is provided, comprising the following steps:

[0135] S901, the client sends an authentication request data packet to the regional network aggregation center switch.

[0136] S902, the regional network aggregation center switch adds a virtual extensible local area network VXLAN tag to the authentication request data packet sent by the client.

[0137] S903, the regional network aggregation center switch forwards the authentication request data packet to the data center switch according to the VXLAN network access policy.

[0138] S904, the data center switch sends an authentication request data packet carrying a VXLAN tag to the zero-trust primary server.

[0139] S905, the zero-trust primary server determines the VXLAN ID tag of the access data packet and performs identity authentication through the VXLAN ID tag.

[0140] S906: After the identity authentication is passed, the zero-trust main server sends a verification success notification message to the zero-trust gateway.

[0141] S907, upon receiving the verification success notification information sent by the zero trust main server, the zero trust gateway generates a session token.

[0142] S908, the zero trust gateway establishes a communication tunnel between the zero trust gateway and the client based on the session token.

[0143] S909, the client sends an access data packet to the regional network aggregation center switch.

[0144] S910, the regional network aggregation center switch adds a VXLAN tag to the access data packet sent by the client.

[0145] S911, the regional network aggregation center switch forwards the access data packet to the zero-trust gateway according to the VXLAN network access policy.

[0146] S912, the zero-trust gateway sends an access data packet to the regional network aggregation center switch.

[0147] S913, the regional network aggregation center switch forwards the access data packet to the data center switch.

[0148] S914: The data center switch forwards the access data packet to the application server.

[0149] S915, the application server responds to the access data packet and sends a response result to the client.

[0150] In the disclosed embodiment, the enterprise network is constructed as a three-level leaf-spine network topology structure of data center nodes, regional network aggregation center nodes and member unit nodes, and VXLAN tags are introduced as identification factors for client identity access at member unit nodes. The authentication mechanism of the zero-trust system is combined to realize the expansion of the enterprise network access control authentication elements, which can significantly reduce the risks of the enterprise network and improve the security of the enterprise network. At the same time, after the data center nodes and member unit nodes are interconnected through the regional network aggregation center node, the data transmission channel of the enterprise network is increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network.

[0151] Combination Fig.10The embodiment of the present disclosure provides an access device 1000 for an enterprise network, including a processor 100 and a memory 101, and may also include a communication interface 102 and a bus 103. The processor 100, the communication interface 102, and the memory 101 may communicate with each other through the bus 103. The communication interface 102 may be used for information transmission. The processor 100 may call the logic instructions in the memory 101 to execute the access method for the enterprise network of the above embodiment.

[0152] In addition, the logic instructions in the memory 101 described above may be implemented in the form of software functional units and when sold or used as independent products, may be stored in a computer-readable storage medium.

[0153] The memory 101 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 100 executes functional applications and data processing by running the program instructions / modules stored in the memory 101, that is, implementing the access method for the enterprise network in the above method embodiment.

[0154] The memory 101 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 101 may include a high-speed random access memory and may also include a non-volatile memory.

[0155] By using access devices for enterprise networks, the enterprise network is constructed into a three-level leaf-spine network topology structure with data center nodes, regional network aggregation center nodes and member unit nodes, and VXLAN tags are introduced as identification factors for client identity access located at member unit nodes. Combined with the authentication mechanism of the zero-trust system, the expansion of enterprise network access control authentication elements can be realized, which can significantly reduce the risks of enterprise networks and improve the security of enterprise networks. At the same time, after the data center nodes and member unit nodes are interconnected through the regional network aggregation center nodes, the data transmission channels of the enterprise network are increased, which can significantly alleviate the congestion of the enterprise network and improve the data transmission rate of the enterprise network.

[0156] An embodiment of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute the above-mentioned access method for an enterprise network.

[0157] An embodiment of the present disclosure provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned access method for an enterprise network.

[0158] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0159] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0160] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, individual components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. The scope of the embodiments of the present disclosure includes the entire scope of the claims, and all available equivalents of the claims. When used in this application, although the terms "first", "second", etc. may be used in this application to describe each element, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without changing the meaning of the description, the first element can be called the second element, and similarly, the second element can be called the first element, as long as all occurrences of the "first element" are renamed consistently and all occurrences of the "second element" are renamed consistently. The first element and the second element are both elements, but may not be the same element. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates, the singular forms "a", "an" and "the" are intended to include the plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups of these. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method or device including the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0161] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0162] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0163] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for accessing an enterprise network, characterized in that: The network hierarchy of the enterprise network is divided into data center nodes, regional network aggregation center nodes and member unit nodes in sequence, and nodes at all levels are connected in sequence according to the SD-WAN method; data center switches and zero-trust main servers are deployed in data center nodes, and regional network aggregation center switches and zero-trust gateways that communicate with zero-trust main servers are deployed in regional network aggregation center nodes; access methods include: The regional network aggregation center switch adds a virtual extensible LAN (VXLAN) tag to the access data packet sent by the client, and forwards the access data packet to the data center switch according to the VXLAN network access policy; Send access data packets carrying VXLAN tags to the zero-trust main server through the data center switch, so that the zero-trust main server verifies the access data packets and notifies the zero-trust gateway to establish a communication tunnel with the client; in: Set up an enterprise network as follows: Deploy data center CPE devices at data center nodes, deploy regional network convergence center CPE devices at regional network convergence center nodes, and deploy member unit CPE devices at member unit nodes; wherein the data center CPE devices, regional network convergence center CPE devices, and member unit CPE devices are networked through binding codes, and the member unit CPE devices are configured to forward data information sent by the client to the regional network convergence center CPE devices; Deploy SDN controllers and data center switches at data center nodes, and deploy regional network convergence center switches at regional network convergence center nodes; wherein the SDN controller is configured to send configuration information to the regional network convergence center switches and data center switches, the regional network convergence center switches are configured to forward data information sent by the regional network convergence center CPE devices to the data center CPE devices according to the configuration information, and the data center switches are configured to forward data information sent by the regional network convergence center CPE devices to the target application servers according to the configuration information; Configure the CPE devices of member units as follows: Convert the IP address of the service access request sent by the client to the target IP address; Based on the target IP address, the converted service access request is forwarded to the CPE device in the target area network aggregation center through the SD-WAN encrypted channel; The target regional network convergence center CPE device is determined in the following manner: multiple regional network convergence center CPE devices located within a preset geographical range centered on the current member unit CPE device are determined; data transmission efficiency of the multiple regional network convergence center CPE devices is determined; wherein the data transmission efficiency characterizes the data transmission speed and transmission accuracy of the regional network convergence center CPE device in the current state; based on the data transmission efficiency, a regional network convergence center CPE device is selected from the multiple regional network convergence center CPE devices as the target regional network convergence center CPE device.

2. The access method according to claim 1, characterized in that: Configure the Zero Trust Gateway as follows: Upon receiving a verification success notification message sent by the zero trust master server, a session token is generated; A communication tunnel is established between the Zero Trust gateway and the client based on the session token.

3. The access method according to claim 1, characterized in that: Configure the Zero Trust Master Server as follows: Determine the VXLAN ID tag of the access data packet and perform identity authentication based on the VXLAN ID tag; After the identity authentication is passed, a verification success notification message is sent to the zero trust gateway.

4. The access method according to claim 1, characterized in that: Also includes: After the zero-trust gateway establishes a communication tunnel with the client, the regional network aggregation center switch adds a virtual extensible local area network VXLAN tag to the access data packet sent by the client, and forwards the access data packet to the zero-trust gateway according to the VXLAN network access policy; The access data packet forwarded by the zero-trust gateway is sent to the application server through the data center switch, so that the application server responds to the access data packet and sends the response result to the client.

5. The access method according to claim 1, characterized in that: Configure the regional network aggregation center switch as follows: Add a virtual extensible local area network (VXLAN) tag to the service access request information according to the IP address information of the service access request information; Match access control policies by VXLAN tags; Forward service access request information to the data center CPE device according to the access control policy.

6. The access method according to claim 1, characterized in that: Configure the SDN controller as follows: Obtaining an abnormal condition of a first regional network aggregation center node; When an abnormality occurs in the first regional network convergence center node, the link of the first regional network convergence center node is switched to the second regional network convergence center node.

7. An access device for an enterprise network, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the access method for an enterprise network according to any one of claims 1 to 6 when running the program instructions.

8. An access system for an enterprise network, characterized in that: include: Data center nodes, deploy zero-trust master servers and data center switches; Regional network aggregation center nodes, deploy zero-trust gateways and regional network aggregation center switches; Member unit node; An access device for an enterprise network as claimed in claim 7.

Images