A resource pool data forwarding method and system

Abstract

The embodiment of the application provides a resource pool data forwarding method and system, and the application relates to the field of data transmission, and the method comprises the following steps: a UPF receives a first data packet transmitted by a data source, performs flow detection on the first data packet, encapsulates a first message identifier for the first data packet that passes the detection, directly forwards the first data packet to a LEAF through a VPN channel, encapsulates a second message identifier for a second data packet that does not pass the detection, and the data packet bypasses a firewall, and the data packet that passes the verification of the firewall is forwarded to the LEAF. According to the method, all the flows bypass the firewall is avoided, unnecessary flow bypassing is reduced, and therefore the data packet forwarding efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data transmission, and in particular to a resource pool data forwarding method and system. BACKGROUND

[0002] Mobile Edge Computing (MEC) is a computing architecture located at the edge of the network, aiming to place computing, storage and application functions closer to users and data sources to reduce latency and improve efficiency. The core concept of MEC is to place cloud computing resources and services close to data sources and end users, achieving this goal by deploying on physical or virtual nodes at the edge of the network close to users.

[0003] An important point is that MEC is a resource pool that centralizes computing, storage and network functions. These resources can be dynamically allocated and managed as needed to meet computing needs in different application scenarios. The resource pool of MEC is usually composed of multiple physical or virtual nodes, which can be deployed on edge devices, base stations, routers or other edge facilities. The resource pool of MEC allows dynamic allocation of computing, storage and network resources according to demand.

[0004] This means that applications can automatically adjust resource usage based on user location, real-time data needs or other conditions to provide better performance and response time. MEC nodes are located at the edge of the network, closer to users and data sources. This location advantage reduces data transmission latency, improves data access speed and bandwidth utilization. In particular, for applications that require fast response (such as intelligent transportation, industrial automation), the low latency characteristics of MEC are crucial. Moving computing and storage functions to the edge of the network can help protect data privacy and improve security. Sensitive data can be processed on edge devices, reducing the risk of data transmission in the network, helping to meet privacy regulations and security standards.

[0005] By deploying applications and services on MEC nodes, users can experience lower latency and higher bandwidth utilization. This architecture also supports various application scenarios, including smart cities, Internet of Things, vehicle-to-vehicle communication and 5G communication. The resource pool concept of MEC enables edge computing to be more flexible and efficient in responding to changing computing needs, thereby providing better user experience and service quality. SUMMARY

[0006] The embodiments of the present application provide a resource pool data forwarding method and system to solve the problem that all traffic needs to pass through the firewall for processing, reducing traffic forwarding efficiency and becoming a bottleneck of network forwarding efficiency. A mechanism is proposed to avoid detour forwarding processing for all traffic while ensuring the security of the MEC resource pool.

[0007] In a first aspect, the embodiments of the present application provide a resource pool data forwarding method, which is applied to a data transmission system, the data transmission system comprising a user switch, an access switch, a center switch, a firewall and an access switch, the user switch being connected with the access switch through a VPN tunnel via the center switch, and the method comprising:

[0008] The user switch receives a first data packet from a data source, and detects the legality of the first data packet through a preset traffic detection mechanism, takes the first data packet passing the detection as a second data packet, and takes the first data packet failing the detection as a third data packet;

[0009] The access switch performs packet encapsulation on the second data packet to obtain a fourth data packet, performs packet encapsulation on the third data packet to obtain a fifth data packet, and transmits the fourth data packet and the fifth data packet to the center switch through the VPN tunnel;

[0010] The center switch forwards the fourth data packet to the access switch through the VPN tunnel, and forwards the fifth data packet to the access switch through a gateway link via the firewall; wherein the firewall is configured to verify the fifth data packet;

[0011] The access switch performs packet decapsulation on the fourth data packet to obtain the second data packet, and performs packet decapsulation on the fifth data packet passing the verification to obtain the third data packet.

[0012] In a possible design, the legality of the first data packet is detected through a preset traffic detection mechanism, the first data packet passing the detection is taken as the second data packet, and the first data packet failing the detection is taken as the third data packet, comprising:

[0013] An authentication request of the first data packet is sent to an authentication server to obtain an authentication result of the first data packet; wherein the authentication result is configured to indicate whether the first data packet comprises abnormal data;

[0014] The first data packet is decoded and analyzed to obtain an analysis result of the first data packet;

[0015] The analysis result is configured to indicate whether the first data packet comprises abnormal behavior;

[0016] The first data packet not comprising the abnormal data and the abnormal behavior is taken as the second data packet, and the first data packet comprising the abnormal data and / or the abnormal behavior is taken as the third data packet.

[0017] In a possible design, the access switch performs packet encapsulation on the second data packet to obtain the fourth data packet, and performs packet encapsulation on the third data packet to obtain the fifth data packet, comprising:

[0018] perform packet encapsulation on the second data packet, and insert the first identifier into a reserved field of a packet header to obtain a fourth data packet; perform packet encapsulation on the third data packet, and insert the second identifier into a reserved field of a packet header to obtain a fifth data packet; wherein the central switch takes the data packet carrying the first identifier as the fourth data packet, and takes the data packet carrying the second identifier as the fifth data packet.

[0019] In a possible design, the access switch performs packet encapsulation on the data packet in a VxLAN format.

[0020] perform packet encapsulation on the second data packet, and insert the first identifier into a reserved field of a packet header to obtain a fourth data packet, including:

[0021] perform virtual extensible local area network (VxLAN) encapsulation on the second data packet, and insert the first identifier into a Reserved field of a VxLAN Header to obtain the fourth data packet.

[0022] perform packet encapsulation on the third data packet, and insert the second identifier into a reserved field of a packet header to obtain a fifth data packet, including:

[0023] perform virtual extensible local area network (VxLAN) encapsulation on the third data packet, and insert the second identifier into a Reserved field of a VxLAN Header to obtain the fifth data packet; wherein the Reserved field in which the second identifier is located has the same position as the Reserved field in which the first identifier is located.

[0024] In a possible design, before the access switch performs packet encapsulation on the second data packet to obtain the fourth data packet, and performs packet encapsulation on the third data packet to obtain the fifth data packet, the method further includes:

[0025] the access switch writes a plurality of first packet information in the second data packet into an entry of a white list; wherein the plurality of first packet information includes: a source address and a destination address.

[0026] In a possible design, after the central switch forwards the fourth data packet to the access switch through a virtual private network (VPN) tunnel, and forwards the fifth data packet to the access switch through a gateway link via a firewall, the method further includes:

[0027] the central switch writes a plurality of second packet information in the fourth data packet into an entry of a maintenance table; wherein the plurality of second packet information includes: a VxLAN ID and a destination MAC address.

[0028] In a possible design, after the access switch writes the plurality of first packet information in the second data packet into an entry of the white list, the method further includes:

[0029] The access switch sets an expiration time of the plurality of first packet information in the white list;

[0030] After the core switch writes the plurality of second packet information in the fourth data packet into an entry of the maintenance table, the method further includes:

[0031] The core switch sets an expiration time of the plurality of second packet information in the maintenance table.

[0032] In a possible design, the forwarding the fifth data packet to the access switch via the gateway link through the firewall includes:

[0033] The core switch transmits the fifth data packet to the firewall via the gateway link;

[0034] The firewall verifies a plurality of data information of the fifth data packet according to a predefined rule, where the predefined rule includes filtering verification, state verification, and intrusion verification, and the plurality of data information includes a source address, a destination address, a protocol type, and data content;

[0035] The firewall forwards the fifth data packet that passes the verification to the access switch via the gateway link.

[0036] In a possible design, before the detecting the legality of the first data packet by using the preset traffic detection mechanism, the method further includes:

[0037] The user switch collects device running data of itself, and obtains resource utilization of the data transmission system according to the device running data, where the device running data includes interface traffic and session quantity, and the resource utilization includes CPU utilization and memory utilization;

[0038] When the resource utilization is greater than a preset threshold, the access switch forwards the first data packet to the access switch via the gateway link through the firewall.

[0039] In a second aspect, an embodiment of the present application provides a resource pool data forwarding system, and the method includes:

[0040] The user switch receives a first data packet from a data source, and detects legality of the first data packet by using a preset traffic detection mechanism; the first data packet that passes the detection is taken as a second data packet, and otherwise, the first data packet is taken as a third data packet;

[0041] an access switch, configured to packetize the second data packet to obtain a fourth data packet, packetize the third data packet to obtain a fifth data packet, and transmit the fourth data packet and the fifth data packet to the center switch through the virtual private network tunnel;

[0042] a center switch, configured to forward the fourth data packet to the access switch through the virtual private network tunnel, and forward the fifth data packet to the access switch through a gateway link via the firewall; wherein the firewall is configured to verify the fifth data packet;

[0043] an access switch, configured to unpack the fourth data packet to obtain the second data packet, and unpack the verified fifth data packet to obtain the third data packet.

[0044] The resource pool data forwarding method and system provided by the embodiment of the application, the user switch receives a first data packet from a data source, and detects the legality of the first data packet through a preset flow detection mechanism; the first data packet that passes the detection is taken as a second data packet, and otherwise, the first data packet is taken as a third data packet; the access switch packetizes the second data packet to obtain a fourth data packet, packetizes the third data packet to obtain a fifth data packet, and transmits the fourth data packet and the fifth data packet to the center switch through a virtual private network tunnel;

[0045] the center switch forwards the fourth data packet to the access switch through the virtual private network tunnel, and forwards the fifth data packet to the access switch through a gateway link via the firewall; wherein the firewall is configured to verify the fifth data packet; the access switch unpacks the fourth data packet to obtain the second data packet, and unpacks the verified fifth data packet to obtain the third data packet. The following technical effects are achieved: by avoiding all flows bypassing the firewall, unnecessary flow bypassing is reduced, and the data packet forwarding efficiency is improved;

[0046] The data transmission is encrypted through the virtual private network tunnel technology, the safety of data transmission between different devices and networks is ensured, and the data packet is prevented from being stolen or tampered with; the center switch establishes and maintains a dynamic table according to the legality of the flow, and assists the subsequent flow forwarding decision, and the flow path is further optimized. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0048] Figure 1 A scenario diagram of a resource pool data forwarding method provided in an embodiment of the present application is shown in FIG. 1.

[0049] Figure 2 A flow diagram of a resource pool data forwarding method provided in an embodiment of the present application is shown in FIG. 2. Figure 1

[0050] Figure 3 A flow diagram of a resource pool data forwarding method provided in an embodiment of the present application is shown in FIG. 3. Figure 2

[0051] Figure 4 A flow diagram of a resource pool data forwarding method provided in an embodiment of the present application is shown in FIG. 4. Figure 3

[0052] Figure 4 A flow diagram of a resource pool data forwarding method provided in an embodiment of the present application is shown in FIG. 5. Figure 1

[0053] Reference signs:

[0054] 110 - terminal; 120 - base station; 130 - UPF; 140 - EOR; 150 - SPINE; 160 - firewall; 170 - LEAF; 180 - resource pool. DETAILED DESCRIPTION

[0055] The exemplary embodiments will be described in detail herein below with reference to the drawings. In the following description, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments are not meant to represent all embodiments in accordance with the present application. Rather, they are merely examples in accordance with some aspects of the present application as detailed in the appended claims.

[0056] In the embodiments of the present application, the terms "first", "second", etc. are used to distinguish the same or similar items or elements with substantially the same function and role. Those skilled in the art can understand that the terms "first", "second", etc. do not limit the quantity and execution order, and the terms "first", "second", etc. do not necessarily mean different. It should be noted that in the embodiments of the present application, the words "exemplary" or "for example" are used to represent an example, illustration or description. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words "exemplary" or "for example" are used to present the relevant concept in a specific manner. In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more.​​​​

[0057] It should be noted that the "at" in the embodiments of the present application can be the moment when a certain condition occurs, or a period of time after a certain condition occurs, and the embodiments of the present application do not make specific limitations. In addition, the edge computing data transmission method provided by the embodiments of the present application is only as an example, and the edge computing data transmission method can also include more or less content.

[0058] In order to clearly describe the technical solutions of the embodiments of the present application, the following briefly introduces some terms and technologies involved in the embodiments of the present application:

[0059] Virtual Private Network (VPN): A secure and encrypted professional channel can be established on a public network. Through this channel, users can transmit data as in a private network, ensuring the privacy, security and integrity of data messages.

[0060] Virtual Professional Network Tunnel: Usually refers to the tunnel technology in VPN. Virtual professional network tunnel creates a secure and encrypted professional channel on the public network to simulate point-to-point direct connection.

[0061] User Plane Function (UPF): A key component in the 5G network architecture, mainly responsible for processing user data plane traffic, can perform deep packet inspection and analyze packet content to identify and filter content-based policies.

[0062] The 5th Generation Mobile Communication Technology (5G).

[0063] Edge of Routing (EOR): Usually refers to the edge part of the network, which is the last router or switch between the network core and user equipment, responsible for routing user traffic to the core network or the Internet, and is also the endpoint of the VPN tunnel, responsible for encrypting and decrypting data transmitted through VPN.

[0064] Spine-and-Leaf: SPINE switches act as the core switching layer, responsible for connecting multiple LEAF switches and forwarding data packets. In the MEC environment, SPINE switches may assume additional roles, such as serving as a bridge connecting MEC nodes and other network components, supporting efficient data forwarding and network services.

[0065] LEAF switches are usually located at the edge of the network architecture, and are directly connected to terminals, servers or resource pools. LEAF switches have high-density ports and support a large number of terminal device connections.

[0066] Firewall (FW): Users monitor data traffic in and out of the network and control and filter traffic according to a set of predetermined security rules to ensure the security of the resource pool.

[0067] Virtual eXtensible Local Area Network (VxLAN) message: refers to a VxLAN format message. It is encapsulated on the basis of a standard Ethernet frame to transmit Layer 2 data frames in an Internet Protocol (IP) network.

[0068] VxLAN Network Identifier (VNI): is a key field of a VxLAN message. It is 24 bits in size and is used to distinguish and identify different VxLAN networks.

[0069] Source physical address (Src.MAC Addr): located in the inner Ethernet header of the VxLAN message. It represents the physical (Media Access Control Address, MAC) address of the source device sending the VxLAN encapsulated data packet.

[0070] Outer source Internet Protocol address (Outer Src.IP): refers to the source IP address encapsulated in the outermost IP header of the VxLAN message. It is the IP address of the device sending the VxLAN message, specifically the IP address of the source VxLAN tunnel endpoint (VTEP).

[0071] Destination Internet Protocol address (Outer Dst.IP): refers to the destination IP address encapsulated in the outermost IP header of the VxLAN message. It is the IP address of the device receiving the VxLAN message, i.e. the IP address of the target VxLAN tunnel endpoint (VTEP).

[0072] Original Ethernet frame: refers to a Layer 2 data frame before the VXLAN encapsulation process. It contains all the basic components of a traditional Ethernet frame.

[0073] Reserved: is a special field in the data packet, Reserved field is reserved for future protocol extensions or new features, so as to add new functions without changing the existing protocol structure, in this application, it is used to mark the data packet corresponding to the legal traffic.

[0074] Edge computing aims to extend data processing and storage functions from traditional cloud computing centers to edge locations close to data sources. In edge computing, data processing occurs closer to the data generation site, usually on devices, sensors, or edge servers, rather than traditional remote cloud servers. Edge computing has broad application potential in various industries, and can realize real-time data analysis and processing, and can reduce data transmission delay.

[0075] MEC is a resource pool that centralizes computing, storage, and network functions. These resources can be dynamically allocated and managed as needed to meet computing needs in different application scenarios. The resource pool of MEC is usually composed of multiple physical or virtual nodes, which can be deployed on edge devices, base stations, routers or other edge facilities. The resource pool of MEC allows dynamic allocation of computing, storage and network resources according to demand. This means that applications can automatically adjust resource usage based on user location, real-time data needs or other conditions to provide better performance and response time. MEC nodes are located at the network edge, closer to users and data sources. This location advantage reduces data transmission delay, improves data access speed and bandwidth utilization. In particular, for applications that require fast response (such as intelligent transportation, industrial automation), the low-latency characteristics of MEC are crucial. Moving computing and storage functions to the network edge can help protect data privacy and improve security. Sensitive data can be processed on edge devices, reducing the risk of data transmission in the network, helping to meet privacy regulations and security standards.

[0076] In the prior art, the data sent by the terminal passes through the network device (base station, UPF, EOR switch and bearer network routing device) and finally reaches the SPINE switch. After that, the traffic is transmitted to the firewall, which deploys relevant policies to selectively process the traffic. After that, the traffic returns to the SPINE switch, and then the traffic passes through the LEAF switch to reach the resource pool.

[0077] In this process, the firewall is the gateway of the entire network, and all traffic (uplink or downlink) must pass through the firewall for processing. The traffic sent by the MEC resource pool passes through the LEAF switch to the SPINE switch, and then enters the firewall again. After passing through the firewall, it returns to the SPINE again, and then it is sent by the SPINE, passing through the bearer network, EOR device, etc., and finally reaching the user terminal.

[0078] Since the MEC resource pool usually has a high security level, all traffic enters the firewall, which is a standard configuration. In order to enhance the security of the system, all legal traffic and illegal traffic need to bypass the firewall, which increases the bypass of the traffic and reduces the efficiency of forwarding.

[0079] However, in practice, the firewall does not need to be configured for different traffic, so the bypass of the traffic is unnecessary at many times, and may make it a bottleneck of network forwarding efficiency.

[0080] To solve the problem that all uplink and downlink traffic needs to pass through the firewall for processing, and the bypass of the traffic increases the low efficiency of traffic forwarding, an embodiment of the present application designs a traffic detection mechanism. By participating in the EOR and other devices, adding a label to the characteristic traffic, and establishing and maintaining a dynamic table of security policies, all uplink and downlink traffic can be avoided to bypass the forwarding processing, while ensuring the security of the MEC resource pool.

[0081] Based on this, an embodiment of the present application provides a resource pool data forwarding method, device and system, which can be used in the field of data transmission, and aims to solve the problem that all uplink and downlink traffic needs to pass through the firewall for processing, and the bypass of the traffic increases the low efficiency of traffic forwarding.

[0082] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0083] Figure 1 A scene diagram of a resource pool data forwarding method provided by an embodiment of the present application is shown. It should be noted that, Figure 1 The shown is only an example of a scene to which the embodiments of the present application can be applied, to help those skilled in the art understand the technical content of the present application, but does not mean that the embodiments of the present application cannot be used in other devices, systems, environments or scenes.

[0084] As Figure 2 shown, a topology structure of an edge computing data transmission method is shown, including a terminal 110, a base station 120, a UPF 130, an EOR 140, a SPINE 150, a firewall 160, a LEAF 170 and a MEC 180.

[0085] In this scenario, terminal 110 sends an access request to resource pool 180 through base station 120, and base station 120 is connected to UPF 130. UPF 130 receives the data packet sent by terminal 110, performs traffic detection on the data packet, and is connected to two EORs 140 representing different network traffic. EOR 140 encapsulates the data packet, and EOR 140 and SPINE 150 transmit the data packet through a VPN tunnel. SPINE 150 is connected to firewall 160 and LEAF 170. The data packet is forwarded to firewall 160 through SPINE 150, and after verification, it is returned to SPINE 150. Alternatively, the data packet can be directly forwarded to LEAF 170 without passing through firewall 160. Multiple LEAFs 170 are connected to different resource pools 180, and finally the data packet sent by terminal 110 is transmitted to resource pool 180.

[0086] Figure 1 Flowchart of a resource pool data forwarding method provided by an embodiment of the present application Figure 2 As shown in Figure 3 , the method is applied to a data transmission system, and the method comprises the following steps:

[0087] S201, the user switch receives a first data packet from a data source, and detects the legality of the first data packet through a preset traffic detection mechanism. The first data packet that passes the detection is taken as a second data packet, and otherwise it is taken as a third data packet;

[0088] Specifically, the UPF receives the data packet through the N3 interface, which is the interface between the base station and the UPF. The data packet sent by the terminal device is not necessarily legal, so the preset traffic detection mechanism judges the legality of the first data packet. The processing methods for legal data packets and ordinary data packets are different, so they need to be marked. The first data packet that passes the detection is marked as a second data packet, and the first data packet that does not pass the detection is marked as a third data packet.

[0089] S202, the access switch encapsulates the second data packet to obtain a fourth data packet, and encapsulates the third data packet to obtain a fifth data packet, and transmits the fourth data packet and the fifth data packet to the central switch through a VPN tunnel;

[0090] Specifically, the EOR device receives the second data packet and the third data packet with marks sent by the UPF side. The data packet needs to be encapsulated with a message before transmission. The header of the encapsulated message has two empty fields. The bit information in the empty fields is used to distinguish the second data packet and the third data packet.

[0091] VPN is a data tunnel, data transmitted by one VPN and another VPN is isolated from each other, and the data is not changed in the process of transmission in the tunnel. This means that if the data is legal traffic when it enters the VPN tunnel at the EOR, it is also a legal traffic when it exits the tunnel and reaches the spine switch.

[0092] S203, the center switch forwards the fourth data packet to the access switch through the VPN tunnel, and forwards the fifth data packet to the access switch through the gateway link via the firewall;

[0093] Specifically, the firewall is used to verify the fifth data packet;

[0094] The SPINE receives the fourth data packet, forwards the fourth data packet to the LEAF through the VPN channel, receives the fifth data packet, forwards the fifth data packet to the firewall for verification first, and returns the fifth data packet to the SPINE after verification, and forwards the fifth data packet to the LEAF through the VPN channel. The fifth data packet needs to be verified by the firewall before entering the resource pool.

[0095] S204, the access switch decapsulates the fourth data packet to obtain the second data packet, and decapsulates the verified fifth data packet to obtain the third data packet;

[0096] Specifically, the LEAF receives the fourth data packet, decapsulates the fourth data packet to obtain the second data packet, accesses the corresponding resource pool according to the destination address in the second data packet, receives

[0097] The fifth data packet, decapsulates the fifth data packet to obtain the third data packet, and accesses the corresponding resource pool according to the destination address in the second data packet.

[0098] The method for forwarding resource pool data provided by the embodiment of the application, the user switch receives the first data packet from the data source, and detects the legality of the first data packet through a preset traffic detection mechanism. The first data packet that passes the detection is taken as the second data packet, otherwise as the third data packet; the access switch encapsulates the second data packet to obtain the fourth data packet, and encapsulates the third data packet to obtain the fifth data packet, and transmits the fourth data packet and the fifth data packet to the SPINE through the VPN tunnel; the SPINE forwards the fourth data packet to the LEAF through the VPN tunnel, and forwards the fifth data packet to the LEAF through the gateway link via the firewall; wherein the firewall is used to verify the fifth data packet;

[0099] The LEAF decapsulates the fourth data packet to obtain a second data packet, and decapsulates the fifth data packet passing the verification to obtain a third data packet. The following technical effects are achieved: unnecessary traffic bypassing is reduced by avoiding all traffic bypassing the firewall, thereby improving the data packet forwarding efficiency; the safety of data transmission between different devices and networks is ensured by encrypting data transmission through the VPN tunnel technology, and data packets are prevented from being stolen or tampered with;

[0100] The SPINE switch establishes and maintains a dynamic table according to the legitimacy of the traffic, and assists the forwarding decision of subsequent traffic, thereby further optimizing the traffic path.

[0101] Figure 2 A flowchart of a resource pool data forwarding method provided by an embodiment of the present application Figure 3 As shown in Figure 4 , the method is applied to a data transmission system, and the method comprises the following steps:

[0102] In S301, the user switch collects device running data of itself, and obtains resource utilization of the data transmission system according to the device running data.

[0103] Specifically, the device running data comprises interface traffic and session quantity, and the resource utilization comprises CPU utilization and memory utilization.

[0104] The UPF is built-in with a monitoring function, periodically collects device running conditions of itself, and when the resource utilization is greater than a preset threshold, the SPINE forwards the first data packet to the LEAF through a gateway link passing through the firewall, reduces the pressure of the UPF, ensures that the processing of the UPF and the firewall on the data packet remains in a dynamically adjusted process, and enhances the stability of the network.

[0105] In S302, the user switch sends an authentication request of the first data packet to an authentication server to obtain an authentication result of the first data packet, decodes and analyzes the first data packet to obtain an analysis result of the first data packet.

[0106] Specifically, the authentication server selected in the embodiment is an AAA server, which is a server for network security and management, and AAA represents identity authentication, authorization and charging. In the embodiment, an authentication request is sent to the AAA server to return an authentication result, and the authentication result is used to indicate whether the first data packet includes abnormal data.

[0107] In the embodiment, the deep packet inspection technology is used to decode and analyze the first data packet, parse each field of the first data packet, extract key information such as source address, destination address, protocol type and port number, perform protocol identification on the first data packet, determine the network protocol of the data packet, and the protocol identification can distinguish whether the first data packet has abnormal behavior.

[0108] The UPF predefines security rules matching the characteristics of the first data packet, which can include a blacklist (rejecting access to a specific IP address or domain name), the IP address in the first data packet cannot be accessed if it is in the blacklist, detecting large-scale connection requests and first data packet size abnormalities, etc. The UPF has multiple analysis mechanisms, and the first data packet that does not include abnormal data and abnormal behavior is the second data packet, and the first data packet that includes abnormal data and / or abnormal behavior is the third data packet.

[0109] In S303, the access switch performs packet encapsulation on the second data packet to obtain a fourth data packet, performs packet encapsulation on the third data packet to obtain a fifth data packet, and transmits the fourth data packet and the fifth data packet to the center switch through a VPN tunnel.

[0110] In S304, the center switch forwards the fourth data packet to the access switch through the VPN tunnel, and forwards the fifth data packet to the access switch through a gateway link via the firewall.

[0111] In S305, the access switch performs decapsulation on the fourth data packet to obtain the second data packet, and performs decapsulation on the verified fifth data packet to obtain the third data packet.

[0112] S303, S304 and S305 are similar to S202, S203 and S204, and will not be described here.

[0113] The technical effect of the embodiments of the present application is that the traffic detection mechanism is pre-set in the UPF, the abnormal data and abnormal behavior of the first data packet are analyzed through the traffic detection mechanism, the first data packet is distinguished, and the first data packet is marked as the second data packet and the third data packet, respectively, solving the problem that all terminal data packets are sent around the firewall for verification, increasing the pressure on the firewall, and reducing the data packet forwarding efficiency.

[0114] Figure 3 A resource pool data forwarding method provided by the embodiments of the present application Figure 4 As shown in FIG. 4, the method is applied to a data transmission system, and the method comprises the following steps: Figure 5

[0115] In S401, the user switch receives a first data packet from a data source, and detects the legality of the first data packet through a pre-set traffic detection mechanism, and the first data packet that passes the detection is the second data packet, otherwise it is the third data packet.

[0116] S401 is similar to S201, and will not be described here.

[0117] ​S402, the access switch writes the plurality of first message information in the second data packet into an entry of the white list, and sets the invalid time of the plurality of second message information in the maintenance table;

[0118] Specifically, the first message information includes: source address and destination address, including IP address and MAC address,

[0119] The second data packet is a legal data packet after detection, and the source address and the destination address in the second data packet are extracted and written into the white list. The white list only allows known and trusted data sources to access. The source address and the destination in the second data packet are written into the white list, and the data packet corresponding to the second data packet does not need to pass through the flow detection mechanism to send an access request, but is directly marked as the second data packet;

[0120] The legal data packet is not necessarily always legal, so the invalid time is set for all entries in the white list. After the invalid time is exceeded, the data source corresponding to the data packet needs to be re-authenticated, and the data packet sent needs to be re-detected through the flow detection mechanism.

[0121] S403, packet encapsulation is performed on the second data packet, and a first identifier is inserted into a reserved field of a message header to obtain a fourth data packet; packet encapsulation is performed on the third data packet, and a second identifier is inserted into a reserved field of a message header to obtain a fifth data packet;

[0122] Specifically, the EOR takes the data packet carrying the first identifier as the fourth data packet, and takes the data packet carrying the second identifier as the fifth data packet.

[0123] The EOR device receives the second data packet and the third data packet sent by the UPF. The EOR performs packet encapsulation on the second data packet. In order to distinguish the second data packet and the third data packet after encapsulation, an identifier is inserted into the reserved field during encapsulation. The message format header of the encapsulated second data packet and third data packet is the same. The outer layer of the message is the source address of the data packet and the address of the first hop. According to the message first hop address, the data packet is forwarded to the next device. The first identifier and the second identifier are used to distinguish the second data packet and the third data packet.

[0124] S404, the second data packet is encapsulated in a virtual extensible local area network, and a first identifier is inserted into a Reserved field of a VxLAN Header to obtain a fourth data packet;

[0125] Specifically, the EOR performs packet encapsulation in the VxLAN format.

[0126] The EOR encapsulates the packet into a VxLAN format message, and the VxLAN header has two Reserved fields, the Reserved fields are occupied empty fields, and the identifier can be in any one of the two Reserved fields.

[0127] S405, the third packet is encapsulated into a virtual extensible local area network (VxLAN) format, and a second identifier is inserted into a Reserved field of the VxLAN header to obtain a fifth packet.

[0128] Specifically, the EOR encapsulates the packet into a VxLAN format message.

[0129] The EOR encapsulates the packet into a VxLAN format message, and the VxLAN header has two Reserved fields, the Reserved fields are occupied empty fields, and the identifier can be in any one of the two Reserved fields.

[0130] S406, the center switch forwards the fourth packet to the access switch through a VPN tunnel, and forwards the fifth packet to the access switch through a gateway link via a firewall.

[0131] S407, the access switch decapsulates the fourth packet to obtain the second packet, and decapsulates the fifth packet to obtain the third packet.

[0132] S406 and S407 are similar to S203 and S204, and details are not repeated in the embodiment.

[0133] The technical effect of the embodiment of the application is that the EOR encapsulates the received packet into a VxLAN format message, which is used to distinguish the second packet and the third packet, the encapsulated message is convenient for transmission in a data transmission system, and the fourth packet and the fifth packet are forwarded to a next hop device according to an outer address of the message.

[0134] Figure 4 A resource pool data forwarding method provided in the embodiment of the application Figure 5 . As shown in the figure, the method is applied to a data transmission system, and the method comprises the following steps. Figure 2

[0135] ​S501, the user switch receives a first data packet from a data source, and detects the legality of the first data packet through a preset flow detection mechanism, takes the first data packet passing the detection as a second data packet, and takes the first data packet failing the detection as a third data packet.

[0136] S502, the access switch performs packet encapsulation on the second data packet to obtain a fourth data packet, performs packet encapsulation on the third data packet to obtain a fifth data packet, and transmits the fourth data packet and the fifth data packet to the center switch through a VPN tunnel.

[0137] S501 and S502 are similar to S201 and S202, and details are not repeated in this embodiment.

[0138] S503, the center switch writes a plurality of second packet information in the fourth data packet into an entry of the maintenance table, and sets the expiration time of the plurality of second packet information in the maintenance table.

[0139] Specifically, the VxLAN ID and the destination MAC address,

[0140] The source address and the destination address in the fourth data packet are extracted and written into the maintenance table. The fourth data packet is in the uplink direction. When the data packet is transmitted from the resource pool to the terminal, the maintenance table is mainly for the downlink of the data packet. Therefore, the resource pool address corresponding to the destination address for transmitting the data packet is also a default legal data packet, that is, the data packet does not pass through the firewall, but is directly forwarded to the EOR through the SPINE.

[0141] The legal data packet is not always legal, so the data packet address in the maintenance table is set with an expiration time. When the time is exceeded, the VxLAN ID and the destination address in the maintenance table are automatically deleted. When the downlink data packet passes through the SPINE, the data packet will bypass the firewall for verification and then return to the SPINE and be forwarded to the EOR.

[0142] S504, the center switch transmits the fifth data packet to the firewall through a gateway link.

[0143] Specifically, the fifth data packet of the SPINE is transmitted to the firewall. In the prior art, the data transmission system needs to forward all data packets to the firewall, return to the SPINE after verification by the firewall, and then forward the data packet to the next hop device.

[0144] In this embodiment, the fifth data packet is obtained by packet encapsulation of the third data packet. The third data packet is a data packet passing through the flow detection mechanism, that is, a data packet corresponding to normal flow. The third data packet needs to be verified by the firewall before entering the resource pool, and the fifth data packet enters the firewall through the gateway link.

[0145] S505, the firewall verifies the multiple data information of the fifth data packet according to the predefined rule, and forwards the verified fifth data packet to the access switch through the gateway link;

[0146] Specifically, the firewall is a network security device for monitoring and controlling network traffic;

[0147] The firewall decides whether to allow or organize specific data packets according to predefined rules. For the fifth data packet, the firewall verifies the fifth data packet by filtering verification, state verification, and intrusion verification, and verifies the source address, destination address, protocol type, and data content of the fifth data packet.

[0148] The SPINE forwards the fifth data packet to the firewall, and the fifth data packet verified by the firewall returns to the SPINE. The fifth data packet verified by the firewall is forwarded to the LEAF through the SPINE and the LEAF transmission link. The fifth data packet that does not pass the firewall verification is not transmitted.

[0149] The firewall forwards the verified fifth data packet to the LEAF through the gateway link.

[0150] S306, the access switch decapsulates the fourth data packet to obtain the second data packet, and decapsulates the verified fifth data packet to obtain the third data packet.

[0151] S306 is similar to S204, and this embodiment will not be described again.

[0152] The technical effect of the embodiment of the application is that the SPINE forwards the fifth data packet to the LEAF through the firewall for verification before forwarding. Only the fifth data packet that passes the verification will be forwarded, which increases the data packet verification mechanism and the data packet forwarding path, enhances the flexibility of the data transmission system, and ensures the safety of the system.

[0153] In a possible design, the EOR sets the invalidation time of the multiple first packet information in the whitelist;

[0154] Specifically, the legitimate data packet is not necessarily always legitimate, and the entry in the whitelist needs to be set with an invalidation time. When the invalidation time is exceeded, the first packet information in the whitelist is automatically deleted, and the data packet corresponding to the source address needs to be detected again through the traffic detection mechanism.

[0155] In a possible design, the SPINE sets the invalidation time of the multiple second packet information in the maintenance table;

[0156] Specifically, the legal data packet is not necessarily always legal, so a time to live is set for the data packet address in the maintenance table, and when the time is exceeded, the VXLAN ID and destination address in the maintenance table are automatically deleted. When the downstream data packet passes through the SPINE, the data packet will bypass the firewall for verification and then return to the SPINE and be forwarded to the EOR.

[0157] The application also provides a resource pool data forwarding system, which comprises: ​

[0158] a UPF, configured to receive a first data packet from a data source, detect the legality of the first data packet through a preset traffic detection mechanism, take the first data packet that passes the detection as a second data packet, and take the first data packet that fails the detection as a third data packet;

[0159] an EOR, configured to perform packet encapsulation on the second data packet to obtain a fourth data packet, perform packet encapsulation on the third data packet to obtain a fifth data packet, and transmit the fourth data packet and the fifth data packet to a central switch through a virtual private network tunnel;

[0160] a SPINE, configured to forward the fourth data packet to an access switch through the virtual private network tunnel, and forward the fifth data packet to the access switch through a gateway link via a firewall, wherein the firewall is configured to verify the fifth data packet;

[0161] a LEAF, configured to perform packet decapsulation on the fourth data packet to obtain the second data packet, and perform packet decapsulation on the fifth data packet that passes the verification to obtain the third data packet;

[0162] The resource pool data forwarding system is used to implement a resource pool data forwarding method.

[0163] Thus, the technical solution of the application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the application is obviously not limited to these specific embodiments, and the above embodiments are only used to illustrate the technical solution of the application, rather than limit it; although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solution recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiments of the application.​

Claims

1. A resource pool data forwarding method, characterized in that, The method is applied to a data transmission system, which includes user switches, access switches, a central switch, a firewall, and access switches. The user switches and the access switches are connected via a virtual private network tunnel through the central switch. The resource pool is an MEC resource pool, and the user switches are UPFs. The method includes: The UPF receives a first data packet from the data source and checks the validity of the first data packet through a preset traffic detection mechanism. The first data packet that passes the detection is used as the second data packet, and the other is used as the third data packet. The access switch encapsulates the second data packet to obtain a fourth data packet and encapsulates the third data packet to obtain a fifth data packet. The fourth data packet and the fifth data packet are then transmitted to the central switch through the virtual private network tunnel. The central switch forwards the fourth data packet to the access switch through the virtual private network tunnel, and forwards the fifth data packet to the access switch through the gateway link via the firewall; wherein, the firewall is used to verify the fifth data packet; The access switch decapsulates the fourth data packet to obtain the second data packet, and decapsulates the verified fifth data packet to obtain the third data packet.

2. The method according to claim 1, characterized in that, The step of detecting the legitimacy of the first data packet through a preset traffic detection mechanism, and using the first data packet that passes the detection as the second data packet, and the other as the third data packet, includes: Send an authentication request for the first data packet to the authentication server to obtain the authentication result of the first data packet; wherein, the authentication result is used to indicate whether the first data packet includes abnormal data; The first data packet is decoded and analyzed to obtain the analysis result of the first data packet; wherein, the analysis result is used to indicate whether the first data packet contains abnormal behavior; The first data packet that does not contain abnormal data and abnormal behavior is used as the second data packet, and the first data packet that includes abnormal data and / or abnormal behavior is used as the third data packet.

3. The method according to claim 1, characterized in that, The access switch encapsulates the second data packet to obtain a fourth data packet, and encapsulates the third data packet to obtain a fifth data packet, including: The second data packet is encapsulated, and a first identifier is inserted into a reserved field in the packet header to obtain the fourth data packet; the third data packet is encapsulated, and a second identifier is inserted into a reserved field in the packet header to obtain the fifth data packet; wherein, the central switch uses the data packet carrying the first identifier as the fourth data packet and the data packet carrying the second identifier as the fifth data packet.

4. The method according to claim 3, characterized in that, The access switch encapsulates data packets in VxLAN format. The process of encapsulating the second data packet and inserting a first identifier into a reserved field in the packet header to obtain the fourth data packet includes: The second data packet is encapsulated in a Virtual Extensible Local Area Network (VxLAN) and the first identifier is inserted into a Reserved field of the VxLAN Header to obtain the fourth data packet. The process of encapsulating the third data packet and inserting a second identifier into a reserved field in the packet header to obtain the fifth data packet includes: The third data packet is encapsulated with a Virtual Extensible Local Area Network (VxLAN), and the second identifier is inserted into a Reserved field of the VxLAN Header to obtain the fifth data packet; wherein the Reserved field containing the second identifier is in the same position as the Reserved field containing the first identifier.

5. The method according to claim 4, characterized in that, Before the access switch encapsulates the second data packet to obtain the fourth data packet, and encapsulates the third data packet to obtain the fifth data packet, the method further includes: The access switch writes multiple first message information from the second data packet into an entry of a whitelist; wherein the multiple first message information includes: source address and destination address.

6. The method according to claim 5, characterized in that, After the central switch forwards the fourth data packet to the access switch through the virtual private network tunnel, and forwards the fifth data packet to the access switch via the gateway link of the firewall, the method further includes: The central switch writes multiple second message information from the fourth data packet into an entry in the maintenance table; wherein, the multiple second message information includes: VxLAN ID and destination MAC address.

7. The method according to claim 6, characterized in that, After the access switch writes multiple first packet information from the second data packet into an entry of the whitelist, the method further includes: The access switch sets the expiration time of the plurality of first message information in the whitelist; After the central switch writes multiple second message information from the fourth data packet into an entry in the maintenance table, the method further includes: The central switch sets the expiration time of the multiple second message information in the maintenance table.

8. The method according to claim 1, characterized in that, The step of forwarding the fifth data packet to the access switch via the gateway link of the firewall includes: The central switch transmits the fifth data packet to the firewall via the gateway link; The firewall verifies multiple data information of the fifth data packet according to predefined rules; wherein, the predefined rules include filtering verification, state verification and intrusion verification, and the multiple data information includes source address, destination address, protocol type and data content; The firewall forwards the verified fifth data packet to the access switch via the gateway link.

9. The method according to claim 1, characterized in that, Before detecting the legitimacy of the first data packet through a preset traffic detection mechanism, the method further includes: The user switch collects its own device operation data and obtains the resource utilization rate of the data transmission system based on the device operation data. The device operation data includes interface traffic and session count, and the resource utilization rate includes CPU utilization and memory utilization. When the resource utilization rate exceeds a preset threshold, SPINE forwards the first data packet to Leaf via the gateway link of the firewall.

10. A resource pool data forwarding system, characterized in that, The system includes: The user exchange is used to receive a first data packet from a data source and to detect the validity of the first data packet through a preset traffic detection mechanism. The first data packet that passes the detection is used as the second data packet; otherwise, it is used as the third data packet. The user exchange is a UPF. The access switch is used to encapsulate the second data packet to obtain the fourth data packet, encapsulate the third data packet to obtain the fifth data packet, and transmit the fourth data packet and the fifth data packet to the central switch through a virtual private network tunnel; A central switch is used to forward the fourth data packet to an access switch through the virtual private network tunnel, and to forward the fifth data packet to the access switch through a gateway link via a firewall; wherein the firewall is used to authenticate the fifth data packet. Access the switch to decapsulate the fourth data packet to obtain the second data packet, and decapsulate the verified fifth data packet to obtain the third data packet.

Images