A method, device and equipment for terminal access to SD-WAN network

Abstract

The embodiments of this specification relate to the field of communication technology, and in particular to a method, apparatus, and device for a terminal to access an SD‑WAN network. The method comprises intercepting a message to be sent by a terminal device in the kernel of the operating system of the terminal device as an uplink message to be encapsulated; sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device; executing a first predetermined application in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent; sending the uplink message to be sent to the kernel, and controlling the kernel to send the uplink message to be sent to a network egress device through the physical network port of the terminal device. Through the embodiments of this specification, the flexibility and forwarding efficiency of terminal devices accessing the SD‑WAN network are improved, and the complexity of management and configuration is reduced.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of communication technology, and in particular, to a method, apparatus and device for a terminal to access an SD-WAN network. Background Art

[0002] In the current software-defined wide area network (SD-WAN) architecture, users generally access the SD-WAN network through the customer premise equipment (CPE) located on the user side. Usually, these CPEs exist in the form of hardware devices and are often deployed at the user's enterprise network exit, that is, the public network exit of the user's enterprise network. Users outside the enterprise network can access the enterprise network through the address of the enterprise network exit.

[0003] Currently, users of enterprise networks install a virtual private network (VPN) client on the terminal device. The VPN client creates a virtual network card on the terminal device, establishes a VPN server at the point-of-presence (PoP) of the local end of the SD-WAN network, and builds a tunnel connection between the terminal device and the PoP. During communication, the VPN client uses the address of the virtual network card as the inner source address and the address of the device inside the enterprise network to be accessed as the inner destination address, and encapsulates the outer source address as the terminal's network card address and the outer destination address as the PoP address. The terminal device sends the message to the PoP through the network card. The VPN server on the PoP parses the message, obtains the inner destination address, and sends the message to the device inside the enterprise network corresponding to the inner destination address through the tunnel between the PoP and the exit of the enterprise network.

[0004] Although this terminal access method can access the enterprise network, it requires the deployment of an additional VPN server on the PoP and a VPN client on the terminal device. In addition, a series of configurations need to be sent on the VPN server and client to import traffic into the enterprise network, which makes management and configuration complicated.

[0005] And in the VPN-like client implementation mode, the default route needs to be pointed to the generated virtual network card, or a more detailed route needs to be pointed to import the traffic that needs to access the SD-WAN network into the virtual network card, so that this method only supports one dimension of filtering conditions (i.e. IP dimension) and cannot achieve fine policy control. This means that there may be some traffic that does not need to be connected to the SD-WAN network, but due to the limitations of the client's capabilities, it cannot be accurately filtered, and thus it will be sent to the server for processing, and the diversion cannot be completed locally. Therefore, the client's flexibility is poor.

[0006] Finally, in the VPN-like client implementation mode, the VPN client first needs to connect to the VPN server before it can access the SD-WAN network. Therefore, the customer's access traffic needs to be transferred through the VPN server. This is not the optimal forwarding path for some customer traffic and may result in detours. Therefore, the forwarding efficiency of this method is not high.

[0007] In summary, the current way of terminal devices accessing the SD-WAN network through VPN has problems such as complex management and configuration, poor flexibility and low forwarding efficiency. How to improve the flexibility and forwarding efficiency of terminal devices accessing the SD-WAN network and reduce the complexity of management and configuration is a technical problem that needs to be solved urgently. Summary of the invention

[0008] In order to solve the problems of complex management and configuration, poor flexibility and low forwarding efficiency of terminal devices accessing the SD-WAN network in the prior art, the embodiments of this specification provide a method, apparatus and equipment for terminal access to the SD-WAN network, which enables the terminal device to directly establish a tunnel connection with the enterprise network exit without the need for secondary encapsulation and forwarding through the PoP node, thereby avoiding detours of the message and improving forwarding efficiency. In addition, the terminal device can be configured with more refined filtering conditions to achieve local diversion on the terminal device, thereby improving the flexibility of the terminal device and eliminating the need to deploy an additional VPN server on the PoP, thereby simplifying management and configuration.

[0009] In order to solve the above technical problems, the specific technical solutions of the embodiments of this specification are as follows:

[0010] On the one hand, an embodiment of this specification provides a method for a terminal to access an SD-WAN network, which is performed by a terminal device, wherein the physical network port of the terminal device can communicate directly with a network egress device in the SD-WAN network or communicate indirectly using forwarding of a point-of-entry device in the SD-WAN network, and the method includes:

[0011] intercepting, in the kernel of the operating system of the terminal device, a message to be sent by the terminal device as an uplink message to be encapsulated;

[0012] Sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device;

[0013] Executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent;

[0014] The uplink message to be sent is sent down to the kernel, and the kernel is controlled to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will take the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

[0015] Further, the first predetermined application includes a strategy based on a combination of one or more elements in a five-tuple.

[0016] Further, the strategy includes a message filtering strategy;

[0017] Executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain the uplink message to be sent further comprises:

[0018] Executing the message filtering strategy on the uplink message to be encapsulated in the application layer to determine whether the uplink message to be encapsulated needs to be encapsulated;

[0019] If yes, encapsulating the uplink message to be encapsulated in the application layer to obtain an uplink message to be sent;

[0020] If not, the uplink message to be encapsulated is directly sent to the kernel, and the kernel is controlled to send out the uplink message to be encapsulated through the physical network port of the terminal device.

[0021] Furthermore, the message filtering strategy includes determining whether the uplink message to be encapsulated is to be sent to the SD-WAN network based on the quintuple of the uplink message to be encapsulated.

[0022] Further, the strategy includes a flow control strategy;

[0023] When the physical network port is capable of communicating with a plurality of network egress devices in the SD-WAN network, executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, and obtaining the uplink message to be sent further includes:

[0024] The flow control strategy is executed in the application layer to determine the target network exit device for receiving the uplink message to be encapsulated, and the uplink message to be encapsulated is encapsulated according to the target network exit device to obtain an uplink message to be sent, so that the controlled kernel can send the uplink message to be sent to the target network exit device through the physical network port.

[0025] Further, the strategy includes an access strategy;

[0026] Executing a first predetermined application program in the application layer to encapsulate the message to be encapsulated further includes:

[0027] The access strategy is executed in the application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the virtual address label corresponding to the terminal device, so that the intranet device uses the virtual address label as the destination address to generate a downlink intranet message corresponding to the uplink intranet message, the inner destination address of the uplink message to be encapsulated is the address of the intranet device, the outer source address is the address of the physical network port of the terminal device, and the outer destination address is the address of the network exit device.

[0028] Further, the network egress device decapsulates the received uplink message to be sent as an uplink message to be decapsulated, and obtaining an uplink intranet message further includes:

[0029] The network egress device strips off the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the inner destination address as the destination address of the uplink message to be decapsulated, to obtain the uplink intranet message;

[0030] The network egress device forwarding the uplink intranet message to the corresponding intranet device in the SD-WAN network further includes:

[0031] The network egress device sends the uplink intranet message to the intranet device corresponding to the destination address of the intranet message.

[0032] Further, after controlling the kernel to send the uplink message to be sent to the network egress device through the physical network port of the terminal device, the method further includes:

[0033] intercepting, in the kernel, a message received by the terminal device as a downlink message to be decapsulated, wherein the downlink message to be decapsulated is a message obtained after the network egress device encapsulates the downlink intranet message;

[0034] Sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0035] Decapsulating the downlink message to be decapsulated in the application layer to obtain a downlink message to be received;

[0036] The downlink message to be received is sent to the kernel for reception.

[0037] Further, when the uplink message to be encapsulated is a message sent by a local application of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further includes:

[0038] Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the physical network port of the terminal device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0039] Sending the downlink message to be received to the kernel for receiving further includes:

[0040] Control the kernel to send the downlink message to be received to the local application.

[0041] Further, when the uplink message to be encapsulated is a message sent by a mobile device in a network hotspot of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further includes:

[0042] Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the mobile device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0043] Sending the downlink message to be received to the kernel for receiving further includes:

[0044] The kernel is controlled to send the downlink message to be received to the mobile device through the network hotspot.

[0045] Based on the same inventive concept, an embodiment of this specification also provides a method for a terminal to access an SD-WAN network, which is executed by a terminal device, and the physical network port of the terminal device can communicate directly with a network egress device in the SD-WAN network or communicate indirectly using forwarding of a point-of-entry device in the SD-WAN network, and the method includes:

[0046] intercepting, in the kernel of the operating system of the terminal device, a message received by the terminal device as a downlink message to be decapsulated;

[0047] Sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0048] Executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated to obtain a downlink message to be received;

[0049] The downlink message to be received is sent to the kernel for reception.

[0050] Further, executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes:

[0051] Determining in the application layer whether the downlink message to be decapsulated needs to be decapsulated;

[0052] If yes, decapsulating the downlink message to be decapsulated in the application layer to obtain a downlink message to be received;

[0053] If not, the downlink message to be decapsulated is directly sent to the kernel for reception.

[0054] Furthermore, the message filtering strategy includes determining whether the downlink message to be decapsulated is a message sent from the SD-WAN network based on the quintuple of the downlink message to be decapsulated.

[0055] Further, when the downlink message to be decapsulated needs to be sent to the local application of the terminal device, executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes:

[0056] Executing the second predetermined application program in the application layer to strip the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the physical network port of the terminal device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0057] Sending the downlink message to be received to the kernel for receiving further includes:

[0058] Control the kernel to send the downlink message to be received to the local application.

[0059] Further, when the downlink message to be decapsulated needs to be sent to a mobile device in the network hotspot of the terminal device, executing a second predetermined application in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes:

[0060] Executing the second predetermined application in the application layer to strip the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the mobile device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0061] Sending the downlink message to be received to the kernel for receiving further includes:

[0062] The kernel is controlled to send the downlink message to be received to the mobile device through the network hotspot.

[0063] Furthermore, after executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated and obtaining a downlink message to be received, the method further includes:

[0064] In the application layer, a strategy based on a single or multiple combination of the five-tuple is executed on the downlink message to be received.

[0065] Based on the same inventive concept, an embodiment of this specification also provides a method for a terminal to access an SD-WAN network, which is applied to the message transmission and reception between a source terminal device and a destination terminal device in the SD-WAN network, wherein the first physical network port of the source terminal device can communicate with the second physical network port of the destination terminal device, and the method includes:

[0066] The first kernel of the operating system of the source terminal device intercepts the message to be sent by the source terminal device as an uplink message to be encapsulated, and sends the uplink message to be encapsulated to the first application layer of the operating system of the source terminal device;

[0067] The first application layer executes a third predetermined application program to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent, and sends the uplink message to be sent to the first kernel, and controls the first kernel to send the uplink message to be sent to the destination terminal device through the first physical network port;

[0068] The second kernel of the operating system of the destination terminal device intercepts the uplink message to be sent received by the destination terminal device as an uplink message to be decapsulated, and sends the uplink message to be decapsulated to the second application layer of the operating system of the destination terminal device;

[0069] The second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated, obtain an uplink message to be received, and send the uplink message to be received to the second kernel for reception.

[0070] Further, the third predetermined application includes a strategy based on a combination of one or more elements in the five-tuple.

[0071] Further, the strategy includes an access strategy;

[0072] The first application layer executing a third predetermined application program to encapsulate the uplink message to be encapsulated further includes:

[0073] The access strategy is executed in the first application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the first virtual address label corresponding to the terminal device, and the inner destination address of the uplink message to be encapsulated is the second virtual address label corresponding to the destination terminal device, so that the destination terminal device uses the first virtual address label as the destination address and the second virtual address label as the source address to generate a downlink message corresponding to the uplink message to be received, the outer source address is the address of the first physical network port, and the outer destination address is the address of the second physical network port.

[0074] Furthermore, the second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated further includes:

[0075] The second application layer executes the fourth predetermined application program to strip the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the address of the second physical network port as the destination address of the uplink message to be decapsulated;

[0076] Sending the uplink message to be received to the second core for receiving further comprises:

[0077] Control the second kernel to send the uplink message to be received to the local application of the destination terminal device.

[0078] Based on the same inventive concept, an embodiment of this specification also provides a device for a terminal to access an SD-WAN network, which is deployed in a terminal device, and the physical network port of the terminal device can communicate directly with a network egress device in the SD-WAN network or communicate indirectly by forwarding a point-of-entry device in the SD-WAN network, and the device includes:

[0079] A first message interception unit, configured to intercept, in the kernel of the operating system of the terminal device, a message to be sent by the terminal device as an uplink message to be encapsulated;

[0080] A first message sending unit, used for sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device;

[0081] A first application layer processing unit, configured to execute a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, so as to obtain an uplink message to be sent;

[0082] A message sending unit is used to send the uplink message to be sent to the kernel, and control the kernel to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will use the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

[0083] Based on the same inventive concept, an embodiment of this specification also provides a device for a terminal to access an SD-WAN network, which is deployed in a terminal device, and the physical network port of the terminal device can communicate directly with a network egress device in the SD-WAN network or communicate indirectly by forwarding a point-of-entry device in the SD-WAN network, and the device includes:

[0084] A second message interception unit, configured to intercept, in the kernel of the operating system of the terminal device, the message received by the terminal device as a downlink message to be decapsulated;

[0085] A second message sending unit, used for sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0086] A second application layer processing unit, configured to execute a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, so as to obtain a downlink message to be received;

[0087] The message receiving unit is used to send the downlink message to be received to the core for reception.

[0088] On the other hand, an embodiment of the present specification further provides a computer device, including a memory, a processor, and a computer program stored in the memory, and when the processor executes the computer program, the method executed by the controller described above is implemented.

[0089] Finally, the embodiments of this specification also provide a computer storage medium on which a computer program is stored. When the computer program is executed by a processor of a computer device, the method executed by the controller described above is executed.

[0090] Using the embodiments of the present specification, the messages to be sent and received by the terminal device are intercepted in the kernel of the terminal device's operating system, and then the intercepted messages are sent to the application layer of the terminal device's operating system. The application program is deployed in the application layer, and the messages sent from the kernel are encapsulated and processed. The encapsulated messages are then sent down to the kernel. The messages are sent to the network exit device in the SD-WAN network through the message sending program in the kernel. The network exit device decapsulates the messages and forwards them to the corresponding intranet device in the SD-WAN network to complete the access of the terminal device.

[0091] Through the method of the embodiment of this specification, the application deployed in the application layer of the terminal device can directly establish a tunnel connection with the intranet device in the SD-WAN network. The application in the application layer sends the message to the corresponding intranet device through the corresponding tunnel by encapsulating the message. The embodiment of this specification does not need to deploy a VPN client in the terminal device, nor does it need to establish a virtual network card on the terminal device. Instead, it directly intercepts the message of the terminal device by kernel interception, and sends the message to the application layer for encapsulation processing. Compared with the VPN client, the method of the embodiment of this specification does not need to send and receive complex configurations on the terminal device, reducing the complexity of management configuration. In addition, the application layer can filter and process the messages of the terminal device in more dimensions, realize fine policy control, and improve the flexibility of the terminal device. Since the method of the embodiment of this specification does not need to deploy a VPN client on the PoP node of the SD-WAN network, the traffic of the terminal device accessing the SD-WAN network device does not need to be transferred through the VPN server, but directly establishes a tunnel connection between the terminal device and the exit of the enterprise network to transmit the message between the terminal device and the exit of the enterprise network. The tunnel is the optimal forwarding path, thereby avoiding detours of the message and improving forwarding efficiency. Finally, although the tunnel itself can support encrypted transmission of messages, the VPN tunnel between the terminal device and the PoP node belongs to the outside of the SD-WAN network through the VPN client. The PoP node will decrypt the received messages, and the tunnel between the PoP node and the exit of the enterprise network belongs to the internal tunnel of the SD-WAN network. Therefore, accessing the SD-WAN network through VPN does not belong to the end-to-end transmission between the terminal device and the exit of the enterprise network. No matter what kind of encryption is used, the PoP node needs to perform decryption once. Therefore, the PoP node is at risk of becoming a leakage point. The embodiment of this specification realizes the direct establishment of tunnel transmission between the terminal device and the exit of the enterprise network, realizes end-to-end encrypted transmission, and the PoP node no longer performs decryption, thereby avoiding the leakage of messages due to the PoP node becoming a leakage point. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0093] Figure 1 The figure shows a schematic diagram of a system for implementing a method for a terminal to access an SD-WAN network according to an embodiment of the present specification;

[0094] Figure 2 The figure shows a schematic diagram of a prior art SD-WAN network access method in an embodiment of this specification;

[0095] Figure 3 The first flow chart of a method for a terminal to access an SD-WAN network according to an embodiment of this specification is shown;

[0096] Figure 4 The second flow chart of a method for a terminal to access an SD-WAN network according to an embodiment of this specification is shown;

[0097] Figure 5 The figure shows a flow chart of executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent in an embodiment of the present specification;

[0098] Figure 6 The figure shows a flow chart of executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated to obtain a downlink message to be received in an embodiment of the present specification;

[0099] Figure 7 The figure is a schematic diagram of the process of a terminal device processing a downlink message in an embodiment of this specification;

[0100] Figure 8 The third flow chart of a method for a terminal to access an SD-WAN network in an embodiment of this specification is shown;

[0101] Fig. 9 The first structural diagram of a device for accessing an SD-WAN network by a terminal according to an embodiment of this specification is shown;

[0102] Fig.10 The second structural diagram of a device for accessing an SD-WAN network by a terminal according to an embodiment of this specification is shown;

[0103] Fig.11 The figure shows a schematic diagram of the structure of a computer device according to an embodiment of the present specification.

[0104]

Description of reference numerals

[0105] 101. Terminal equipment;

[0106] 102. PoP node;

[0107] 1031, headquarters network exit;

[0108] 1032, branch network exit;

[0109] 1041, headquarters intranet;

[0110] 1042. Branch intranet;

[0111] 901, a first message interception unit;

[0112] 902, first message sending unit;

[0113] 903, a first application layer processing unit;

[0114] 904, message sending unit;

[0115] 1001. A second message interception unit;

[0116] 1002, second message sending unit;

[0117] 1003, second application layer processing unit;

[0118] 1004, message receiving unit;

[0119] 1102. Computer equipment;

[0120] 1104. Processing equipment;

[0121] 1106. Storage resources;

[0122] 1108. Driving mechanism;

[0123] 1110, input / output module;

[0124] 1112. Input device;

[0125] 1114. Output device;

[0126] 1116. Presentation equipment;

[0127] 1118. Graphical user interface;

[0128] 1120. Network interface;

[0129] 1122. Communication link;

[0130] 1124. Communication bus. DETAILED DESCRIPTION

[0131] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the embodiments of this specification.

[0132] It should be noted that the terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0133] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0134] like Figure 1 The diagram is a schematic diagram of a system for implementing a method for terminal access to an SD-WAN network according to an embodiment of the specification, which may include: a terminal device 101, a PoP node 102, a headquarters intranet 1041, a headquarters network exit 1031, a branch intranet 1042, and a branch network exit 1032. The branch intranet 1042 and the branch network exit 1032 are not necessarily present. For example, if some enterprises have only one office park, only the headquarters intranet 1041 and the headquarters network exit 1031 exist.

[0135] The SD-WAN network includes a network structure consisting of a PoP node 102, a headquarters intranet 1041, a headquarters network exit 1031, a branch intranet 1042, and a branch network exit 1032. When there is a branch intranet 1042 and a branch network exit 1032, the branch intranet 1042 and the headquarters intranet 1041 may not belong to the same network, that is, the devices in the branch intranet 1042 cannot directly communicate with the devices in the headquarters intranet 1041, and they need to communicate through the tunnel between the headquarters network exit 1031 and the branch network exit 1032, that is, the device at one end of the tunnel encapsulates the message and then transmits it into the tunnel, and the device at the other end of the tunnel decapsulates the message and then forwards it to the corresponding device in the intranet.

[0136] Among them, both the headquarters network exit 1031 and the branch network exit 1032 can correspond to CPE. In most scenarios, the ports of the CPE of the headquarters network exit 1031 and the branch network exit 1032 are connected to the PoP node 102 in the SD-WAN network. The PoP node 102 is the access point of the SD-WAN network, which is usually connected to the public network. Devices in the public network can access the SD-WAN network through the access point.

[0137] Multiple PoP nodes 102 can be deployed in the SD-WAN network, and the terminal device 101 accesses the SD-WAN network through any PoP node 102.

[0138] The schematic diagram of the SD-WAN network access method in the prior art is as follows Figure 2 As shown, if the mobile office terminal device 101 (that is, the device outside the headquarters intranet 1041 and the branch intranet 1042) wants to access the headquarters intranet 1041 or the branch intranet 1042, it is necessary to deploy a VPN client, such as an IPSec VPN client, on the terminal device 101. After the VPN client is enabled, a virtual network card will be established on the terminal device and the address of the virtual network card will be configured. A VPN server is deployed on the PoP node 102.

[0139] When the terminal device 101 accesses the headquarters intranet 1041 or the branch intranet 1042 through VPN, the terminal device 101 starts the VPN client, creates a virtual network card and configures the IP address. The IP address of the virtual network card is in the same network segment as the tunnel peer address. When sending packets, the kernel sends the destination address and the IP address of the virtual network card in the same network segment to the interface corresponding to the virtual network card through the default route. The interface corresponds to the VPN client program. The VPN client program encapsulates and encrypts the message, and then transmits the message to the corresponding PoP node in the SD-WAN network through the tunnel. The VPN server on the PoP node decrypts the data packet and sends it to the corresponding headquarters network exit 1031 or branch network exit 1032 through the tunnel. The headquarters network exit 1031 or branch network exit 1032 forwards the message to the corresponding headquarters intranet 1041 and the devices in the branch intranet 1042.

[0140] It can be seen that in the prior art method of terminal devices accessing the SD-WAN network, the tunnel from the terminal device to the PoP node is actually outside the SD-WAN network, the tunnel transmission quality is uncontrollable, and it is unable to enjoy the overall optimization strategy of the SD-WAN network quality and the rapid fault recovery strategy. However, the tunnel from the PoP node to the CPE belongs to the SD-WAN network, and this tunnel can apply the overall optimization strategy of the SD-WAN network quality and the rapid fault recovery strategy. It is impossible to improve the transmission quality of the terminal device accessing the SD-WAN network.

[0141] In addition, because the kernel sends the destination address and the IP address of the virtual network card in the same network segment to the corresponding interface of the virtual network card through the default route, this method only supports one dimension of filtering conditions (i.e., the IP dimension) and cannot achieve fine policy control. This means that there may be some traffic that does not need to be connected to the SD-WAN network, but is limited by the client's capabilities and cannot be accurately filtered, so it will be sent to the server for processing and cannot be diverted locally.

[0142] On the other hand, if the user of the terminal device has higher requirements for traffic security, because the terminal device and the PoP node adopt a VPN-like architecture, the end-to-end transmission between the terminal device and the intranet device will be divided into two sections (terminal device to PoP node, PoP node to CPE). No matter how the user traffic is encrypted, it needs to be decrypted once at the PoP node, which will make PoP a potential risk point for security leakage, which means that the end-to-end security capabilities cannot be met.

[0143] In response to the problems existing in the methods of terminal devices accessing SD-WAN networks in the prior art, the embodiments of this specification provide a method for terminal devices to access SD-WAN networks, which enables the terminal device to directly establish a tunnel connection with the enterprise network exit without the need for secondary encapsulation and forwarding at the PoP, thereby avoiding detours in messages and improving forwarding efficiency. The terminal device can also be configured with more refined filtering conditions to achieve local diversion on the terminal device, thereby improving the flexibility of the terminal device and eliminating the need to deploy an additional VPN server on the PoP, thereby simplifying management and configuration.

[0144] Figure 3 The flowchart of a method for a terminal to access an SD-WAN network according to an embodiment of the present specification is shown. This figure describes the process of a terminal device sending a message to an intranet device in the SD-WAN network, but more or fewer operation steps may be included based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many steps, and does not represent the only execution order. When the system or device product is executed in practice, it can be executed in sequence or in parallel according to the method shown in the embodiment or the accompanying drawings.

[0145] Specific as Figure 3 As shown, it is executed by the terminal device, and the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly by forwarding the access point device in the SD-WAN network.

[0146] The method comprises:

[0147] Step 301: intercepting a message to be sent by the terminal device in the kernel of the operating system of the terminal device as an uplink message to be encapsulated;

[0148] Step 302: Sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device;

[0149] Step 303: executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, to obtain an uplink message to be sent;

[0150] Step 304: Send the uplink message to be sent down to the kernel, and control the kernel to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will take the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

[0151] Correspondingly, the embodiment of this specification also provides a method for a terminal to access an SD-WAN network, such as Figure 4 As shown, in this figure, a process of receiving a message sent by an intranet device in an SD-WAN network by a terminal device is described, which is executed by the terminal device, and the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly by forwarding the access point device in the SD-WAN network, and the method includes:

[0152] Step 401: intercepting a message received by the terminal device in the kernel of the operating system of the terminal device as a downlink message to be decapsulated;

[0153] Step 402: Send the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0154] Step 403: executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, to obtain a downlink message to be received;

[0155] Step 404: Send the downlink message to be received to the kernel for reception.

[0156] Using the embodiments of the present specification, the messages to be sent and received by the terminal device are intercepted in the kernel of the terminal device's operating system, and then the intercepted messages are sent to the application layer of the terminal device's operating system. The application program is deployed in the application layer, and the messages sent from the kernel are encapsulated and processed. The encapsulated messages are then sent down to the kernel. The messages are sent to the network exit device in the SD-WAN network through the message sending program in the kernel. The network exit device decapsulates the messages and forwards them to the corresponding intranet device in the SD-WAN network to complete the access of the terminal device.

[0157] Through the method of the embodiment of this specification, the application deployed in the application layer of the terminal device can directly establish a tunnel connection with the intranet device in the SD-WAN network. The application in the application layer sends the message to the corresponding intranet device through the corresponding tunnel by encapsulating the message. The embodiment of this specification does not need to deploy a VPN client in the terminal device, nor does it need to establish a virtual network card on the terminal device. Instead, it directly intercepts the message of the terminal device by kernel interception, and sends the message to the application layer for encapsulation processing. Compared with the VPN client, the method of the embodiment of this specification does not need to send and receive complex configurations on the terminal device, reducing the complexity of management configuration. In addition, the application layer can filter and process the messages of the terminal device in more dimensions, realize fine policy control, and improve the flexibility of the terminal device. Since the method of the embodiment of this specification does not need to deploy a VPN client on the PoP node of the SD-WAN network, the traffic of the terminal device accessing the SD-WAN network device does not need to be transferred through the VPN server, but directly establishes a tunnel connection between the terminal device and the exit of the enterprise network to transmit the message between the terminal device and the exit of the enterprise network. The tunnel is the optimal forwarding path, thereby avoiding detours of the message and improving forwarding efficiency.

[0158] In the embodiments of the present specification, the physical network port of the terminal device and the network egress device (CPE) in the SD-WAN network can be in the same network segment, and the two communicate directly, or the physical network port of the terminal device and the point of presence device (PoP device) in the SD-WAN network are in the same network segment, and the terminal device communicates with the CPE through the PoP device.

[0159] In some other embodiments of this specification, the terminal device may also be in the local area network on the terminal device side, and connected to the CPE in the SD-WAN network through the upper-level firewall and switch, which is not limited by the embodiments of this specification.

[0160] In the embodiment of the present specification, firstly, a message to be sent by the terminal device is intercepted in the operating system of the terminal device as an uplink message to be encapsulated.

[0161] Exemplarily, the operating system of the terminal device can be an authorized Windows operating system, and a WFP (Windows Filtering Platform) driver is created in the kernel state of the Windows operating system, wherein the WFP driver layer creates a control device through the WFP API, which is responsible for intercepting all data packets at the IP layer.

[0162] Create a driver device in the Windows operating system kernel and register 6 callouts to the WFP filter engine. They are:

[0163] Get the IPv4 data packets received by the local machine at the FWPM_LAYER_INBOUND_IPPACKET_V4 layer, get the IPv6 data packets received by the local machine at the FWPM_LAYER_INBOUND_IPPACKET_V6 layer, get the IPv4 data packets sent by the local machine at the FWPM_LAYER_OUTBOUND_IPPACKET_V4 layer, get the IPv6 data packets sent by the local machine at the FWPM_LAYER_OUTBOUND_IPPACKET_V6 layer, get the IPv4 data packets forwarded by the local machine at the FWPM_LAYER_IPFORWARD_V4 layer, and get the IPv6 data packets forwarded by the local machine at the FWPM_LAYER_IPFORWARD_V6 layer. Then set a callback function for each annotation to send the data packets passing through it to the application in the application layer.

[0164] Four handles are created for the above-mentioned driver device for redelivering data packets processed by the application layer application, which respectively represent: delivering IPv4 packets in the inbound direction, delivering IPv6 packets in the inbound direction, delivering IPv4 packets in the outbound direction, and delivering IPv6 packets in the outbound direction.

[0165] Open a WFP filter engine session, then add the six registered annotations to the WFP filter engine, and set the filter with the filter condition empty (that is, pass all IPv4 and IPv6 packets).

[0166] The user-mode application program at the application layer always obtains data packets (uplink messages to be encapsulated) from the filter points created above, and redelivers the data packets through the corresponding handles after processing.

[0167] Then, a predetermined application program is executed in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent. The encapsulation process may include encapsulation of source address and destination address, encryption of message content, etc., which is not limited in the embodiments of this specification.

[0168] Then the application layer sends the uplink message to be sent to the kernel, and controls the kernel to send the uplink message to be sent to the network egress device through the physical network port of the terminal device.

[0169] It can be understood that, through the above method, the function of CPE is realized in the application layer of the terminal, the terminal device is used as CPE, and the physical network port of the terminal device is used as the physical port of CPE. In addition, other application processing programs of the user can also be run on the terminal device, which is equivalent to turning the terminal device into a CPE with richer processing content. The traditional terminal device needs to establish a tunnel connection with the PoP node, which is replaced by the terminal device directly establishing a tunnel connection with the CPE device at the intranet exit. The traffic between the terminal device and the PoP node is also divided into the intranet traffic of SD-WAN, realizing true end-to-end transmission between the terminal device and the CPE, facilitating network quality optimization, rapid fault recovery, and improving end-to-end security.

[0170] Before the message is transmitted, a tunnel connection is established between the physical network port of the terminal device and the physical port of the CPE. No matter how many hops there are between the terminal device and the CPE, the tunnel is the shortest transmission path. After the application layer of the terminal device encapsulates the uplink message, it is sent to the corresponding tunnel, which can be transmitted to the network exit device at the other end of the tunnel by the shortest path. The network exit device then decapsulates the received message and forwards it to the corresponding intranet device.

[0171] For downlink messages, the network exit device encapsulates the downlink messages sent by the intranet device to the terminal device, and then sends them to the terminal device through the tunnel. Therefore, the messages received by the terminal device are intercepted in the kernel of the terminal device's operating system as downlink messages to be decapsulated, and the downlink messages to be decapsulated are sent to the application layer of the terminal device's operating system, and a second predetermined application is executed in the application layer to decapsulate the downlink messages to be decapsulated to obtain downlink messages to be received, and finally the downlink messages to be received are sent down to the kernel for reception, and the kernel will send the downlink messages to the corresponding applications for processing according to the records.

[0172] In the embodiments of the present specification, because the CPE function is implemented on the terminal device, the first predetermined application program of the application layer may include a strategy based on one or more components of the five-tuple to achieve more sophisticated filtering processing of the message.

[0173] According to an embodiment of the present specification, the policy includes a message filtering policy.

[0174] Specifically, Figure 5 As shown, executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain the uplink message to be sent further includes:

[0175] Step 501: Execute the message filtering strategy on the uplink message to be encapsulated in the application layer to determine whether the uplink message to be encapsulated needs to be encapsulated;

[0176] Step 502: If yes, encapsulate the uplink message to be encapsulated in the application layer to obtain an uplink message to be sent;

[0177] Step 503: If not, directly sending the uplink message to be encapsulated to the kernel, and controlling the kernel to send the uplink message to be encapsulated through the physical network port of the terminal device.

[0178] In an embodiment of the present specification, the kernel of the operating system of the terminal device can intercept all messages transmitted by the terminal device, but there may be some messages that are not sent to the SD-WAN network. Therefore, in an embodiment of the present specification, a five-tuple-based message filtering strategy is deployed at the application layer of the terminal device to determine whether the uplink message to be encapsulated is to be sent to the SD-WAN network based on the five-tuple of the uplink message to be encapsulated. If so, encapsulation processing is performed. If not, the message is directly delivered back to the kernel so that the kernel can send the message through the physical network port.

[0179] Correspondingly, for the downlink messages received by the terminal device, the judgment rules automatically generated by the system after the tunnel is established can be used to determine whether the downlink messages received by the terminal device need to be decapsulated. The judgment rules can determine whether the downlink messages are sent by the SD-WAN network by judging the address and port of the downlink messages.

[0180] Specifically, Figure 6 As shown, executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes:

[0181] Step 601: Determine in the application layer whether the downlink message to be decapsulated needs to be decapsulated;

[0182] Step 602: If yes, decapsulate the downlink message to be decapsulated in the application layer to obtain a downlink message to be received;

[0183] Step 603: If not, directly send the downlink message to be decapsulated to the kernel for reception.

[0184] According to an embodiment of the present specification, in order to avoid message congestion, the embodiment of the present specification can also deploy a flow control strategy at the application layer.

[0185] Specifically, when the physical network port is capable of communicating with a plurality of network egress devices in the SD-WAN network, executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, and obtaining the uplink message to be sent further includes:

[0186] The flow control strategy is executed in the application layer to determine the target network exit device for receiving the uplink message to be encapsulated, and the uplink message to be encapsulated is encapsulated according to the target network exit device to obtain an uplink message to be sent, so that the controlled kernel can send the uplink message to be sent to the target network exit device through the physical network port.

[0187] Specifically, the flow control strategy can be a five-tuple-based strategy, which determines which tunnel the message should go through according to the source address, destination address, protocol, etc. of the message, and then encapsulates the message according to the determined tunnel (that is, the determined target network exit device), and then sends the encapsulated message to the kernel, which sends it to the corresponding tunnel.

[0188] According to one embodiment of the present specification, the policy includes an access policy;

[0189] Executing a first predetermined application program in the application layer to encapsulate the message to be encapsulated further includes:

[0190] The access strategy is executed in the application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the virtual address label corresponding to the terminal device, so that the intranet device uses the virtual address label as the destination address to generate a downlink intranet message corresponding to the uplink intranet message, the inner destination address of the uplink message to be encapsulated is the address of the intranet device, the outer source address is the address of the physical network port of the terminal device, and the outer destination address is the address of the network exit device.

[0191] In the embodiments of this specification, the virtual address label is not the virtual IP address of the virtual network card, but an address label pre-assigned to the terminal device. The role of the address label is to serve as the inner source address of the uplink message to be sent when the uplink message is encapsulated. The inner destination address of the uplink message to be sent is the address of the intranet device. The uplink message to be sent needs to be sent to the corresponding tunnel for transmission. Therefore, the outer source address of the uplink message to be sent is the address of the physical network port of the terminal device, and the outer destination address of the uplink message to be sent is the address of the network exit device.

[0192] The virtual address label is used by the intranet device to generate a downlink intranet message corresponding to the uplink intranet message using the virtual address label as the destination address. Therefore, the virtual address labels of different terminal devices should be different to avoid address conflicts.

[0193] In some other embodiments of this specification, in addition to encapsulating the outer address and modifying the inner address, the application layer can also encrypt the message. The existing tunnel encryption method can be used for encryption, which is not described in detail in the embodiments of this specification.

[0194] Correspondingly, the network egress device decapsulates the received uplink message to be sent as an uplink message to be decapsulated, and obtains an uplink intranet message further comprising:

[0195] The network egress device strips off the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the inner destination address as the destination address of the uplink message to be decapsulated, to obtain the uplink intranet message;

[0196] The network egress device forwarding the uplink intranet message to the corresponding intranet device in the SD-WAN network further includes:

[0197] The network egress device sends the uplink intranet message to the intranet device corresponding to the destination address of the intranet message.

[0198] In an embodiment of the present specification, after the network exit device at the other end of the tunnel receives the message sent by the terminal device, it decapsulates the message, that is, it strips off the outer source address and the outer destination address of the uplink message to be decapsulated, uses the inner source address as the source address of the uplink message to be decapsulated, and uses the inner destination address as the destination address of the uplink message to be decapsulated, obtains the uplink intranet message, and then forwards the uplink intranet message to the intranet device corresponding to its destination address. For the intranet device, the source address of the message it receives is the virtual address label of the terminal device. When returning the packet, it uses the virtual address label as the destination address of the downlink intranet message, and sends the downlink intranet message to the network exit device. The network exit device encapsulates the downlink intranet message in the reverse direction and sends it to the terminal device.

[0199] According to one embodiment of this specification, Figure 7 As shown, after controlling the kernel to send the uplink message to be sent to the network egress device through the physical network port of the terminal device, the method further includes:

[0200] Step 701: intercepting, in the kernel, a message received by the terminal device as a downlink message to be decapsulated, wherein the downlink message to be decapsulated is a message obtained after the network egress device encapsulates the downlink intranet message;

[0201] Step 702: Send the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0202] Step 703: Decapsulating the downlink message to be decapsulated in the application layer to obtain a downlink message to be received;

[0203] Step 704: Send the downlink message to be received to the kernel for reception.

[0204] In the embodiment of the present specification, the same method as step 401 is used in the kernel to intercept the message received by the terminal device as the downlink message to be decapsulated, and then the downlink message to be decapsulated is sent to the application layer of the operating system of the terminal device, which is decapsulated by the application layer to obtain the downlink message to be received, and then delivered back to the kernel for reception. It should be noted that the second predetermined application (that is, the decapsulation application) in step 403 can be executed in the application layer to decapsulate the downlink message to be decapsulated, wherein the second predetermined application is a decapsulation policy corresponding to the access policy of the encapsulated uplink message, and the downlink message to be decapsulated is decapsulated.

[0205] Specifically, according to an embodiment of the present specification, when the uplink message to be encapsulated is a message sent by a local application of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further includes:

[0206] Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the physical network port of the terminal device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0207] Sending the downlink message to be received to the kernel for receiving further includes:

[0208] Control the kernel to send the downlink message to be received to the local application.

[0209] According to one embodiment of the present specification, the terminal device can also be used as a network hotspot, and the mobile device connects to the network hotspot to access the SD-WAN network. At this time, the source address of the uplink message sent by the mobile device is the physical address of the mobile device, and the destination address is the address of the intranet device in the SD-WAN network. The mobile device sends the uplink message to the terminal device through the network hotspot. When the terminal device receives the uplink message sent by the mobile device, it executes the method of steps 301-304 to encapsulate the message and send it to the intranet device. At this time, the source address of the message received by the intranet device is the physical address of the mobile device. Therefore, when the intranet device replies, the physical address of the mobile device is used as the source address.

[0210] When the uplink message to be encapsulated is a message sent by a mobile device in a network hotspot of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further comprises:

[0211] Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the mobile device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received;

[0212] Sending the downlink message to be received to the kernel for receiving further includes:

[0213] The kernel is controlled to send the downlink message to be received to the mobile device through the network hotspot.

[0214] According to one embodiment of the present specification, after step 403 obtains the downlink message to be received, a strategy based on a single or multiple combination of the five-tuple can be executed on the downlink message to be received in the application layer, such as executing a speed limit strategy, a statistical strategy, etc. on the downlink message to be received, which is not limited by the embodiment of the present specification.

[0215] Through the embodiments of this specification, a CPE-like function is implemented on the terminal device, and a tunnel connection between the network egress devices (hardware CPE) of the terminal device intranet can be established, and the tunnel is divided into the SD-WAN network, which is convenient for the configuration of network optimization and other policies. Compared with the traditional VPN framework, the embodiments of this specification do not need to set up a proxy server on the terminal, nor do they need to issue traffic processing policies on the proxy server, thereby reducing the complexity of management configuration.

[0216] In addition, compared to the traditional VPN framework, the embodiments of the present specification can implement more fine-grained traffic classification at the application layer of the terminal device's operating system, such as five-tuple-based message filtering policies, flow control policies, message access policies, etc., which can achieve the management of all data traffic on the terminal device, while avoiding the access of traffic that does not need to be connected to the SD-WAN network to the SD-WAN network, thereby realizing diversion on the terminal device side.

[0217] Through the method of the embodiments of this specification, the application layer of the terminal device can support more traffic control functions, which is convenient for functional expansion, because the classification and actions of all data packets can be implemented in the user-state application. Only the user-state application needs to be upgraded to support new functional features, which has good scalability.

[0218] In the prior art, terminal devices based on VPN-like frameworks must send all traffic to the server for processing. However, in the SD-WAN client of this solution, terminal devices can establish tunnels with multiple CPE or PoP nodes on demand and use the SD-WAN network for path optimization, thus having lower network latency.

[0219] In addition, the SD-WAN client in the embodiment of this specification can not only support the traffic access of the host where it is located, but also support the devices connected to the hotspot to access the SD-WAN network by monitoring the configuration of the mobile hotspot. As a result, the application layer policy of the terminal device is not only applied to the traffic of the host where it is located, but also supports the traffic of the hotspot. This further enriches the access methods of the SD-WAN network and improves the ease of use of the SD-WAN.

[0220] The SD-WAN client in the embodiment of this specification can support both IPv4 and IPv6 dual stacks. The application of the terminal device can support the acquisition and processing of IPv4 and IPv6 user traffic according to the issued policy, and the outer layer of the tunnel itself supports both IPv4 and IPv6 protocols. Therefore, the tunnel encapsulation can support four forms of IPv4 over IPv4, IPv6 over IPv4, IPv4 over IPv6, and IPv6 over IPv4 at the same time, thereby improving the compatibility of terminal devices accessing the SD-WAN network.

[0221] Based on the same inventive concept, the embodiment of this specification also provides a method for a terminal to access an SD-WAN network. Figure 3 and Figure 4 The difference between the method shown is that the method of this embodiment is applied to the message sending and receiving between terminal devices, that is, the message sending and receiving between the source terminal device and the destination terminal device in the SD-WAN network, and the first physical network port of the source terminal device can communicate with the second physical network port of the destination terminal device.

[0222] For example, the source terminal device is located outside the SD-WAN network, and the destination terminal device is located within the SD-WAN network. Figure 3 A similar method implements CPE-like functions, thereby establishing a tunnel connection between the source terminal device and the destination terminal device. At this time, the PoP node and the equipment at the enterprise network exit no longer decrypt the message, but simply forward it, thereby realizing a direct tunnel connection between the terminal devices.

[0223] Specifically, Figure 8 As shown, the method includes:

[0224] Step 801: The first kernel of the operating system of the source terminal device intercepts the message to be sent by the source terminal device as an uplink message to be encapsulated, and sends the uplink message to be encapsulated to the first application layer of the operating system of the source terminal device;

[0225] Step 802: the first application layer executes a third predetermined application program to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent, and sends the uplink message to be sent to the first kernel, and controls the first kernel to send the uplink message to be sent to the destination terminal device through the first physical network port;

[0226] Step 803: The second kernel of the operating system of the destination terminal device intercepts the uplink message to be sent received by the destination terminal device as an uplink message to be decapsulated, and sends the uplink message to be decapsulated to the second application layer of the operating system of the destination terminal device;

[0227] Step 804: The second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated, obtain an uplink message to be received, and send the uplink message to be received to the second kernel for reception.

[0228] In the embodiment of the present specification, the third predetermined application program may be the same as the first predetermined application program in step 303, and the fourth predetermined application program may be the same as the second predetermined application program in step 403, which will not be described in detail here.

[0229] Therefore, the third predetermined application also includes a strategy based on a single or multiple combination of the five-tuple to achieve the above-mentioned message filtering, flow control and message access, which will not be repeated here.

[0230] The first application layer executing a third predetermined application program to encapsulate the uplink message to be encapsulated further includes:

[0231] The access strategy is executed in the first application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the first virtual address label corresponding to the terminal device, and the inner destination address of the uplink message to be encapsulated is the second virtual address label corresponding to the destination terminal device, so that the destination terminal device uses the first virtual address label as the destination address and the second virtual address label as the source address to generate a downlink message corresponding to the uplink message to be received, the outer source address is the address of the first physical network port, and the outer destination address is the address of the second physical network port.

[0232] In the terminal-to-terminal scenario of the embodiment of this specification, the inner source address of the message sent by the source terminal device is the first virtual address label of the source terminal device, and the inner destination address is the second virtual address label of the destination terminal device. When the destination terminal device replies, the source address is its own second virtual address label, and the destination address is the first virtual address label.

[0233] The second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated further comprising:

[0234] The second application layer executes the fourth predetermined application program to strip the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the address of the second physical network port as the destination address of the uplink message to be decapsulated;

[0235] Sending the uplink message to be received to the second core for receiving further comprises:

[0236] Control the second kernel to send the uplink message to be received to the local application of the destination terminal device.

[0237] Based on the same inventive concept, the embodiment of this specification also provides a device for terminal access to SD-WAN network, which is deployed in the terminal device, and the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly by forwarding the access point device in the SD-WAN network, such as Fig. 9 As shown, the device comprises:

[0238] A first message interception unit 901, configured to intercept, in the kernel of the operating system of the terminal device, a message to be sent by the terminal device as an uplink message to be encapsulated;

[0239] A first message sending unit 902, configured to send the uplink message to be encapsulated to the application layer of the operating system of the terminal device;

[0240] A first application layer processing unit 903 is used to execute a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent;

[0241] The message sending unit 904 is used to send the uplink message to be sent to the kernel, and control the kernel to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will use the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

[0242] Correspondingly, the embodiment of this specification also provides a device for a terminal to access the SD-WAN network, which is deployed in a terminal device, and the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly by forwarding the access point device in the SD-WAN network, such as Fig.10 As shown, the device comprises:

[0243] A second message interception unit 1001 is used to intercept the message received by the terminal device in the kernel of the operating system of the terminal device as a downlink message to be decapsulated;

[0244] The second message sending unit 1002 is used to send the downlink message to be decapsulated to the application layer of the operating system of the terminal device;

[0245] The second application layer processing unit 1003 is used to execute a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated to obtain a downlink message to be received;

[0246] The message receiving unit 1004 is used to send the downlink message to be received to the kernel for reception.

[0247] The beneficial effects obtained by the above system are consistent with the beneficial effects obtained by the above method, and will not be described in detail in the embodiments of this specification.

[0248] like Fig.11The structure diagram of the computer device of the embodiment of this specification is shown. The apparatus in this specification can be the computer device in this embodiment, and the method in this specification is executed. The computer device 1102 may include one or more processing devices 1104, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 1102 may also include any storage resource 1106, which is used to store any kind of information such as code, settings, data, etc. Non-limiting, for example, the storage resource 1106 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any storage resource can use any technology to store information. Further, any storage resource can provide volatile or non-volatile retention of information. Further, any storage resource can represent a fixed or removable component of the computer device 1102. In one case, when the processing device 1104 executes an associated instruction stored in any storage resource or a combination of storage resources, the computer device 1102 can perform any operation of the associated instruction. The computer device 1102 also includes one or more drive mechanisms 1108 for interacting with any storage resources, such as a hard disk drive mechanism, an optical disk drive mechanism, and the like.

[0249] The computer device 1102 may also include an input / output module 1110 (I / O) for receiving various inputs (via input devices 1112) and for providing various outputs (via output devices 1114). A specific output mechanism may include a presentation device 1116 and an associated graphical user interface (GUI) 1118. In other embodiments, the input / output module 1110 (I / O), input device 1112, and output device 1114 may not be included, and the computer device 1102 may be used as a computer device in a network. The computer device 1102 may also include one or more network interfaces 1120 for exchanging data with other devices via one or more communication links 1122. One or more communication buses 1124 couple the components described above together.

[0250] The communication link 1122 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 1122 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0251] The embodiments of the present specification also provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0252] The embodiments of the present specification also provide a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to execute the above method.

[0253] It should be understood that in the various embodiments of this document, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0254] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0255] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this article.

[0256] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0257] In the several embodiments provided herein, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0258] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0259] In addition, each functional unit in each embodiment of this invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

[0260] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this article is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this article. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0261] Specific embodiments are used in this article to illustrate the principles and implementation methods of this article. The description of the above embodiments is only used to help understand the methods and core ideas of this article. At the same time, for general technicians in this field, according to the ideas of this article, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on this article.

Claims

1. A method for a terminal to access an SD-WAN network, characterized in that: The method is executed by a terminal device, wherein the physical network port of the terminal device can directly communicate with a network egress device in the SD-WAN network or communicate indirectly by forwarding a point-of-presence device in the SD-WAN network, and the method includes: intercepting, in the kernel of the operating system of the terminal device, a message to be sent by the terminal device as an uplink message to be encapsulated; Sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device; Executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent; The uplink message to be sent is sent down to the kernel, and the kernel is controlled to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will take the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

2. The method according to claim 1, characterized in that The first predetermined application includes a policy based on a combination of one or more of the five-tuple.

3. The method according to claim 2, characterized in that The strategy includes a message filtering strategy; Executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated to obtain the uplink message to be sent further comprises: Executing the message filtering strategy on the uplink message to be encapsulated in the application layer to determine whether the uplink message to be encapsulated needs to be encapsulated; If yes, encapsulating the uplink message to be encapsulated in the application layer to obtain an uplink message to be sent; If not, the uplink message to be encapsulated is directly sent to the kernel, and the kernel is controlled to send out the uplink message to be encapsulated through the physical network port of the terminal device.

4. The method according to claim 3, characterized in that The message filtering strategy includes determining whether the uplink message to be encapsulated is to be sent to the SD-WAN network based on the quintuple of the uplink message to be encapsulated.

5. The method according to claim 2, characterized in that: The strategy includes a flow control strategy; When the physical network port is capable of communicating with a plurality of network egress devices in the SD-WAN network, executing a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, and obtaining the uplink message to be sent further includes: The flow control strategy is executed in the application layer to determine the target network exit device for receiving the uplink message to be encapsulated, and the uplink message to be encapsulated is encapsulated according to the target network exit device to obtain an uplink message to be sent, so that the controlled kernel can send the uplink message to be sent to the target network exit device through the physical network port.

6. The method according to claim 2, characterized in that The strategy includes an access strategy; Executing a first predetermined application program in the application layer to encapsulate the message to be encapsulated further includes: The access strategy is executed in the application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the virtual address label corresponding to the terminal device, so that the intranet device uses the virtual address label as the destination address to generate a downlink intranet message corresponding to the uplink intranet message, the inner destination address of the uplink message to be encapsulated is the address of the intranet device, the outer source address is the address of the physical network port of the terminal device, and the outer destination address is the address of the network exit device.

7. The method according to claim 6, characterized in that The network egress device decapsulates the received uplink message to be sent as an uplink message to be decapsulated, and obtains an uplink intranet message, further comprising: The network egress device strips off the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the inner destination address as the destination address of the uplink message to be decapsulated, to obtain the uplink intranet message; The network egress device forwarding the uplink intranet message to the corresponding intranet device in the SD-WAN network further includes: The network egress device sends the uplink intranet message to the intranet device corresponding to the destination address of the intranet message.

8. The method according to claim 6, characterized in that After controlling the kernel to send the uplink message to be sent to the network egress device through the physical network port of the terminal device, the method further includes: intercepting, in the kernel, a message received by the terminal device as a downlink message to be decapsulated, wherein the downlink message to be decapsulated is a message obtained after the network egress device encapsulates the downlink intranet message; Sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device; Decapsulating the downlink message to be decapsulated in the application layer to obtain a downlink message to be received; The downlink message to be received is sent to the kernel for reception.

9. The method according to claim 8, characterized in that When the uplink message to be encapsulated is a message sent by a local application of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further comprises: Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the physical network port of the terminal device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received; Sending the downlink message to be received to the kernel for receiving further includes: Control the kernel to send the downlink message to be received to the local application.

10. The method according to claim 8, characterized in that When the uplink message to be encapsulated is a message sent by a mobile device in a network hotspot of the terminal device, decapsulating the downlink message to be decapsulated in the application layer to obtain the downlink message to be received further comprises: Stripping the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the mobile device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received; Sending the downlink message to be received to the kernel for receiving further includes: The kernel is controlled to send the downlink message to be received to the mobile device through the network hotspot.

11. A method for a terminal to access an SD-WAN network, characterized in that: The method is executed by a terminal device, wherein the physical network port of the terminal device can directly communicate with a network egress device in the SD-WAN network or communicate indirectly by forwarding a point-of-presence device in the SD-WAN network, and the method includes: intercepting, in the kernel of the operating system of the terminal device, a message received by the terminal device as a downlink message to be decapsulated; Sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device; Executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated to obtain a downlink message to be received; The downlink message to be received is sent to the kernel for reception.

12. The method according to claim 11, characterized in that Executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes: Determining in the application layer whether the downlink message to be decapsulated needs to be decapsulated; If yes, decapsulating the downlink message to be decapsulated in the application layer to obtain a downlink message to be received; If not, the downlink message to be decapsulated is directly sent to the kernel for reception.

13. The method according to claim 11, characterized in that When the downlink message to be decapsulated needs to be sent to the local application of the terminal device, executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes: Executing the second predetermined application program in the application layer to strip the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the physical network port of the terminal device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received; Sending the downlink message to be received to the kernel for receiving further includes: Control the kernel to send the downlink message to be received to the local application.

14. The method according to claim 11, characterized in that When the downlink message to be decapsulated needs to be sent to a mobile device in the network hotspot of the terminal device, executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, and obtaining the downlink message to be received further includes: Executing the second predetermined application in the application layer to strip the outer source address and the outer destination address of the downlink message to be decapsulated, and using the inner source address of the downlink message to be decapsulated as the source address of the downlink message to be decapsulated, and using the address of the mobile device as the destination address of the downlink message to be decapsulated, to obtain the downlink message to be received; Sending the downlink message to be received to the kernel for receiving further includes: The kernel is controlled to send the downlink message to be received to the mobile device through the network hotspot.

15. The method according to claim 11, characterized in that After executing a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated to obtain a downlink message to be received, the method further includes: In the application layer, a strategy based on a single or multiple combination of the five-tuple is executed on the downlink message to be received.

16. A method for a terminal to access an SD-WAN network, characterized in that: Applied to the message transmission and reception between a source terminal device and a destination terminal device in an SD-WAN network, the first physical network port of the source terminal device being able to communicate with the second physical network port of the destination terminal device, the method comprising: The first kernel of the operating system of the source terminal device intercepts the message to be sent by the source terminal device as an uplink message to be encapsulated, and sends the uplink message to be encapsulated to the first application layer of the operating system of the source terminal device; The first application layer executes a third predetermined application program to encapsulate the uplink message to be encapsulated to obtain an uplink message to be sent, and sends the uplink message to be sent to the first kernel, and controls the first kernel to send the uplink message to be sent to the destination terminal device through the first physical network port; The second kernel of the operating system of the destination terminal device intercepts the uplink message to be sent received by the destination terminal device as an uplink message to be decapsulated, and sends the uplink message to be decapsulated to the second application layer of the operating system of the destination terminal device; The second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated, obtain an uplink message to be received, and send the uplink message to be received to the second kernel for reception.

17. The method according to claim 16, characterized in that The third predetermined application includes a policy based on a combination of one or more of the five-tuple.

18. The method according to claim 17, characterized in that The strategy includes an access strategy; The first application layer executing a third predetermined application program to encapsulate the uplink message to be encapsulated further includes: The access strategy is executed in the first application layer to encapsulate the outer source address and the outer destination address of the uplink message to be encapsulated, and the inner source address is modified, wherein the inner source address is the first virtual address label corresponding to the terminal device, and the inner destination address of the uplink message to be encapsulated is the second virtual address label corresponding to the destination terminal device, so that the destination terminal device uses the first virtual address label as the destination address and the second virtual address label as the source address to generate a downlink message corresponding to the uplink message to be received, the outer source address is the address of the first physical network port, and the outer destination address is the address of the second physical network port.

19. The method according to claim 18, characterized in that The second application layer of the operating system of the destination terminal device executes a fourth predetermined application program to decapsulate the uplink message to be decapsulated further comprising: The second application layer executes the fourth predetermined application program to strip the outer source address and the outer destination address of the uplink message to be decapsulated, and uses the inner source address as the source address of the uplink message to be decapsulated, and uses the address of the second physical network port as the destination address of the uplink message to be decapsulated; Sending the uplink message to be received to the second core for receiving further comprises: Control the second kernel to send the uplink message to be received to the local application of the destination terminal device.

20. A device for a terminal to access an SD-WAN network, characterized in that: Deployed in a terminal device, the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly using the forwarding of the point-of-entry device in the SD-WAN network, and the device includes: A first message interception unit, configured to intercept, in the kernel of the operating system of the terminal device, a message to be sent by the terminal device as an uplink message to be encapsulated; A first message sending unit, used for sending the uplink message to be encapsulated to the application layer of the operating system of the terminal device; A first application layer processing unit, configured to execute a first predetermined application program in the application layer to encapsulate the uplink message to be encapsulated, so as to obtain an uplink message to be sent; A message sending unit is used to send the uplink message to be sent to the kernel, and control the kernel to send the uplink message to be sent to the network exit device through the physical network port of the terminal device, so that the network exit device will use the received uplink message to be sent as an uplink message to be decapsulated and decapsulate it to obtain an uplink intranet message, and forward the uplink intranet message to the corresponding intranet device in the SD-WAN network.

21. A device for a terminal to access an SD-WAN network, characterized in that: Deployed in a terminal device, the physical network port of the terminal device can communicate directly with the network egress device in the SD-WAN network or communicate indirectly using the forwarding of the point-of-entry device in the SD-WAN network, and the device includes: A second message interception unit, configured to intercept, in the kernel of the operating system of the terminal device, the message received by the terminal device as a downlink message to be decapsulated; A second message sending unit, used for sending the downlink message to be decapsulated to the application layer of the operating system of the terminal device; A second application layer processing unit, configured to execute a second predetermined application program in the application layer to decapsulate the downlink message to be decapsulated, so as to obtain a downlink message to be received; The message receiving unit is used to send the downlink message to be received to the core for reception.

22. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method described in any one of claims 1 to 19 is implemented.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 19 is implemented.

Images