Message processing method and device, equipment and storage medium

Abstract

The invention provides a message processing method and device, equipment and a storage medium, under the condition that a first network isolation area receives a first message, an identifier of the first network isolation area, quintuple information of the first message and a source-target MAC are stored in a corresponding session, and the session and a second message are stored. The second message is the first message which does not contain the source-target MAC address; and under the condition that the second network isolation area obtains the second message, determining a corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area, restoring the source and target MAC address of the second message according to the session, and forwarding the second message. By storing the identifier of the network isolation area, the quintuple information of the message and the original source and target MAC address in the session corresponding to the message, the session can be obtained in the corresponding network isolation area by using the quintuple information of the message, so that the original source and target MAC address of the message can be effectively restored by using the session when the message is sent.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method, device, equipment and storage medium. Background Art

[0002] The network devices working in Layer 2 transparent mode are designed not to modify the MAC addresses in the messages passing through. When receiving the messages, such network devices will retain the original source and destination MAC addresses of the messages, and after processing, use the original source and destination MAC address information to re-encapsulate the messages for forwarding.

[0003] However, when the network device working in Layer 2 transparent mode is logically divided into multiple network isolation areas, the original source and destination MAC addresses of the message will be stored in the network isolation area used to receive the message. Since the MAC address tables in different network isolation areas are independent, the network isolation area used to send the message cannot obtain the original source and destination MAC addresses of the message, resulting in packet sending failure.

[0004] In the related art, a network device learns the MAC address corresponding to the destination IP by receiving an Address Resolution Protocol (ARP) message and stores it in the ARP table of the network device. When sending a message, the network device will query the ARP table to obtain the MAC address corresponding to the destination IP address and set it as the destination MAC address of the message. However, the above solution still cannot obtain the original source MAC address of the message, resulting in the original source MAC of the message being unable to be restored. Summary of the invention

[0005] In view of this, the present application provides a message processing method, apparatus, device and storage medium to address the deficiencies in the related art.

[0006] In a first aspect of the present application, a message processing method is provided, which is applied to a network device, wherein the network device is pre-divided into a plurality of network isolation areas, and the method comprises:

[0007] When a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and five-tuple information and a source-destination MAC address of the first message are stored in a session corresponding to the first message, and the session and a second message are stored, wherein the second message is the first message that does not include the source-destination MAC address;

[0008] When the second network isolation area among the multiple network isolation areas obtains the second message, the corresponding session is determined according to the quintuple information of the second message and the identifier of the first network isolation area, and the source and destination MAC addresses of the second message are restored and forwarded according to the source and destination MAC addresses stored in the determined session.

[0009] According to an embodiment of the present application, the network device pre-stores message identification information, the message identification information including a destination IP, a destination port, and a protocol type, and the method further includes:

[0010] When a message is received in the first network isolation area, the message is parsed to obtain five-tuple information of the message;

[0011] Determine whether the five-tuple information of the message matches the message identification information;

[0012] If there is a match, it is determined that the first message is received;

[0013] If there is no match, the message is forwarded from the first network isolation area to the next hop device according to the destination MAC address of the message.

[0014] According to an embodiment of the present application, the network device pre-stores message identification information, the message identification information including a destination IP, a destination port, and a protocol type, and the method further includes:

[0015] In the case where the second network isolation area obtains the message to be sent, determining whether the quintuple information of the message to be sent matches the message identification information;

[0016] If there is a match, it is determined that the second message is obtained;

[0017] If there is no match, the destination IP of the message to be sent is used to match the Address Resolution Protocol ARP table in the second network isolation area, and according to the matched ARP table entry, the message to be sent is forwarded from the second network isolation area to the next hop device.

[0018] According to an embodiment of the present application, the network device pre-stores service information, the service information includes an encryption and decryption algorithm and an encryption and decryption certificate, and the method further includes:

[0019] When the first network isolation area receives the first message, decrypt the first message according to the service information; wherein the second message is the decrypted first message;

[0020] When the second network isolation area obtains the second message, the second message is encrypted according to the service information.

[0021] According to an embodiment of the present application, the multiple network isolation areas of the network device further include a third network isolation area, and when the second network isolation area among the multiple network isolation areas obtains the second message, before determining the corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area, the method further includes:

[0022] In the case where the third network isolation area obtains the second message, according to the MAC address table in the third network isolation area, adding the source and destination MAC addresses to the second message, and forwarding the second message after the source and destination MAC addresses are added to the target network device, so that the target network device processes the second message after the source and destination MAC addresses are added;

[0023] Receive the processed second message returned by the target network device, and store the second message.

[0024] In a second aspect of the present application, a message processing device is provided, which is applied to a network device, wherein the network device is pre-divided into a plurality of network isolation areas, and the device comprises:

[0025] A first processing unit, configured to store, when a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and five-tuple information and a source-destination MAC address of the first message in a session corresponding to the first message, and store the session and a second message, wherein the second message is the first message that does not include the source-destination MAC address;

[0026] The second processing unit is used to determine the corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area when the second network isolation area among the multiple network isolation areas obtains the second message, and restore the source and destination MAC addresses of the second message according to the source and destination MAC addresses stored in the determined session and then forward it.

[0027] According to one embodiment of the present application, the device further includes:

[0028] A third processing unit is configured to, before the second processing unit performs processing, add a source-destination MAC address to the second message according to a MAC address table in the third network isolation area when the second message is acquired in the third network isolation area, and forward the second message to which the source-destination MAC address is added to a target network device, so that the target network device processes the second message to which the source-destination MAC address is added;

[0029] Receive the processed second message returned by the target network device, and store the second message.

[0030] In a third aspect of the present application, an electronic device is provided, including a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor is used to execute the machine executable instructions to implement the steps of the method proposed in the above embodiment.

[0031] In a fourth aspect of the present application, a machine-readable storage medium is provided, wherein the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by a processor, the steps of the method proposed in the above embodiment are implemented.

[0032] In a fifth aspect of the present application, a computer program product is provided, comprising a computer program / instruction, which implements the steps of the method proposed in the above embodiment when executed by a processor.

[0033] It can be seen from the above technical solution that when a network device working in Layer 2 transparent mode is logically divided into multiple network isolation areas, by saving the identifier of the network isolation area, the five-tuple information of the message and the original source and destination MAC address in the session corresponding to the message, according to the characteristic that the five-tuple information remains unchanged after the message passes through the network device with transparent mode enabled, the five-tuple information of the message can be used to query the session in the corresponding network isolation area to obtain the original source and destination MAC address of the message, so that the original source and destination MAC address of the message can be effectively restored when sending the message.

[0034] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flowchart of a message processing method provided in an embodiment of the present application;

[0036] Figure 2A and Figure 2B They are respectively a flow chart of a first network isolation area and a flow chart of a second network isolation area provided in an embodiment of the present application;

[0037] Figure 3 It is a flowchart of a message processing method provided by another embodiment of the present application;

[0038] Figure 4 It is a structural schematic diagram of a message processing device provided in an embodiment of the present application;

[0039] Figure 5 It is a schematic diagram of the hardware structure of an electronic device shown in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0040] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0041] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0042] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and understandable, the technical solutions in the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0043] The network devices working in Layer 2 transparent mode are designed to keep the original source and destination MAC addresses (i.e. source MAC address and destination MAC address) of the data packet unchanged to achieve transparent transmission. However, when these network devices are logically divided into multiple network isolation areas, the original source and destination MAC addresses of the message will be stored in the network isolation area where the message is received. Since the MAC address tables in each network isolation area are independent of each other, the network isolation area responsible for sending the message cannot obtain the original source and destination MAC addresses of the message, resulting in the inability to correctly encapsulate and forward the message.

[0044] Currently, network devices can learn the MAC address corresponding to the destination IP by receiving the Address Resolution Protocol (ARP) message. However, the ARP message can only obtain the destination MAC, but still cannot obtain the original source MAC of the message, resulting in the original source MAC of the message cannot be restored.

[0045] If the original source MAC of the message cannot be restored, the access control and policies implemented based on the MAC address will become invalid; or, in some network environments, the MAC address is an important means of identifying and managing network devices. Therefore, if the original source MAC of the message cannot be restored, it will cause confusion in network device identification and management, etc.

[0046] In view of this, an embodiment of the present application discloses a message processing method to solve the deficiencies in the related technology.

[0047] like Figure 1 As shown, Figure 1 It is a flow chart of a message processing method provided in an embodiment of the present application. The message processing method can be applied to a network device, and the network device is pre-divided into multiple network isolation areas.

[0048] Exemplarily, the above-mentioned network devices may include switches, firewalls, load balancers, etc. The embodiments of the present application do not specifically limit the types of network devices.

[0049] In some embodiments, the above network device may be a network device operating in a layer 2 transparent mode.

[0050] Among them, Layer 2 refers to the Layer 2 network (data link layer) in the Open System Interconnect (OSI) model. The data link layer is responsible for establishing and disconnecting links on physical media, managing the transmission of data frames between network nodes, and ensuring that data frames can be accurately transmitted from the source device to the destination device.

[0051] Transparent mode means that the network device will not make any obvious modifications or interference to the traffic when processing it. For the terminal device, the network device with transparent mode turned on is invisible, that is, the network device with transparent mode turned on is transparent to the terminal device, and the terminal device is unaware of the existence of these network devices.

[0052] Network isolation refers to dividing a network into multiple independent parts or areas by logical or physical means, and establishing secure and reliable boundaries between these parts or areas to limit the flow of data and access to resources. In the embodiments of the present application, network isolation refers to logical isolation, that is, the network device is logically pre-divided into multiple network isolation areas.

[0053] The embodiments of the present application do not specifically limit the method of pre-dividing a network device into multiple network isolations. For example, multiple physical interfaces (ports) of a network device can be assigned to different network areas to achieve network isolation; or, a network device can be pre-divided into multiple network isolations by configuring a virtual local area network (VLAN) to create multiple virtual networks, configuring access control lists (ACLs) to limit the traffic of different network segments, and other methods.

[0054] The message processing method may include the following steps:

[0055] S101: When a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and five-tuple information and source-destination MAC addresses of the first message are stored in a session corresponding to the first message, and the session and a second message are stored, wherein the second message is the first message without the source-destination MAC addresses.

[0056] In an embodiment of the present application, the network device can be logically divided into multiple network isolation areas in advance, and a unique identifier can be configured for each network isolation area, and specific functions or services can be configured for each network isolation area in advance, wherein the first network isolation area is configured to receive messages from the terminal device, for example, the first network isolation area can be used to receive messages sent by the client to the server.

[0057] In some embodiments, the network device may pre-store message identification information, and the message identification information may include a destination IP, a destination port, and a protocol type.

[0058] When a message is received in the first network isolation area, the message can be parsed to obtain the five-tuple information of the message. After obtaining the five-tuple information of the message, it can be determined whether the five-tuple information of the message matches the message identification information. If they match, it is determined that the first message is received; if they do not match, the message is forwarded from the first network isolation area to the next hop device according to the destination MAC address of the message.

[0059] More specifically, the five-tuple information of the message includes the source IP address, destination IP address, source port, destination port and transport layer protocol. It can be determined whether the destination IP, destination port and protocol type in the five-tuple information of the message are the same as the destination IP, destination port and protocol type in the message identification information.

[0060] If the destination IP, destination port and protocol type in the message quintuple information are the same as the destination IP, destination port and protocol type in the message identification information, it is determined that the first network isolation area has received the first message; otherwise, it is determined that the message received by the first network isolation area is not the first message.

[0061] When it is determined that the message received in the first network isolation area is not the first message, the MAC address table in the first network isolation area can be queried based on the destination MAC address of the message. If an entry corresponding to the destination MAC address of the message is found in the MAC address table of the first network isolation area, the message can be forwarded from the corresponding port to the next-hop device based on the queried entry.

[0062] In some embodiments, when the first message is received in the first network isolation area, the first message may be parsed to obtain five-tuple information of the first message;

[0063] The five-tuple information of the message can be used to uniquely identify a session, so the session table in the first network isolation area can be queried according to the five-tuple information of the first message;

[0064] If a session corresponding to the five-tuple information of the first message is not found in the session table of the first network isolation area, a session corresponding to the first message may be created in the session table of the first network isolation area, and an identifier of the first network isolation area, the five-tuple information of the first message, and the source and destination MAC addresses (i.e., the source MAC address and the destination MAC address) of the first message are stored in the session;

[0065] If a session corresponding to the five-tuple information of the first message is found in the session table of the first network isolation area, the information stored in the session can be updated according to the first message. In some embodiments, if a session corresponding to the five-tuple information of the first message is found in the session table of the first network isolation area, the source and destination MAC addresses stored in the session can be updated according to the source and destination MAC addresses of the first message.

[0066] In some embodiments, after the identifier of the first network isolation area and the five-tuple information and source-destination MAC addresses of the first message are stored in the session corresponding to the first message, the session and the second message corresponding to the first message can be stored in the memory of the network device. The session and the second message stored in the memory of the network device can be shared among various network isolation areas, that is, other network isolation areas can obtain the session and the second message from the memory of the network device.

[0067] More specifically, the session and the second message corresponding to the first message may be stored in a specific memory area in the network device memory, respectively, and other network isolation areas may obtain the session and the second message by reading the specific memory area.

[0068] The MAC address tables in each network isolation area are independent of each other, and the above-mentioned second message is the first message that does not include the source and destination MAC addresses.

[0069] In some embodiments, the network device may pre-store service information, and after receiving the first message, the first network isolation area may further perform a first process on the first message according to the service information stored in the network device.

[0070] In some embodiments, business information may be pre-stored in a network device, and the business information may include encryption and decryption algorithms (such as a Secure Socket Layer SSL algorithm, a Transport Layer Security TLS algorithm, etc.) and encryption and decryption certificates (such as an SSL certificate, a TLS certificate, etc.), and the first message received in the first network isolation area is an encrypted message. After the first message is received in the first network isolation area, the first message may be decrypted according to the encryption and decryption algorithm and encryption and decryption certificate included in the business information. When the second message is stored in the memory of the network device, the second message at this time is the decrypted first message that does not contain the source and destination MAC addresses.

[0071] S102: When the second network isolation area among the multiple network isolation areas obtains the second message, the corresponding session is determined according to the five-tuple information of the second message and the identifier of the first network isolation area, and the source and destination MAC addresses of the second message are restored and forwarded according to the source and destination MAC addresses stored in the determined session.

[0072] In an embodiment of the present application, the network device can be logically divided into multiple network isolation areas in advance, and specific functions or services can be pre-configured for each network isolation area, wherein the second network isolation area is configured to send messages, for example, the second network isolation area can be used to send messages to the server.

[0073] In some embodiments, the network device may pre-store message identification information, and the message identification information may include a destination IP, a destination port, and a protocol type.

[0074] When the message to be sent is obtained in the second network isolation area, the message to be sent can be parsed to obtain the five-tuple information of the message to be sent. After obtaining the five-tuple information of the message to be sent, it can be determined whether the five-tuple information of the message to be sent and the message identification information match. If they match, it is determined that the second message is obtained; if they do not match, the destination IP of the message to be sent is used to match the ARP table in the second network isolation area, and according to the matched ARP table entry, the message to be sent is forwarded from the second network isolation area to the next hop device.

[0075] More specifically, it can be determined whether the destination IP, destination port and protocol type in the five-tuple information of the message to be sent are the same as the destination IP, destination port and protocol type in the message identification information.

[0076] If the destination IP, destination port, and protocol type in the five-tuple information of the message to be sent are the same as the destination IP, destination port, and protocol type in the message identification information, it is determined that the second network isolation area obtains the second message, otherwise, it is determined that the message to be sent obtained by the second network isolation area is not the second message. Exemplarily, if the message to be sent obtained by the second network isolation area is not the second message, then the message to be sent may be a message to be sent by a specific function or service pre-configured in the second network isolation area.

[0077] For messages to be sent by a specific function or service pre-configured in the second network isolation area, the network device can learn the MAC address corresponding to the destination IP through the ARP message and store it in the ARP table of the second network isolation area.

[0078] When it is determined that the message to be sent obtained by the second network isolation area is not the second message, the destination IP of the message to be sent can be used to match the ARP table of the second network isolation area. If an entry corresponding to the destination IP of the message to be sent is matched in the ARP table of the second network isolation area, the source and destination MAC addresses in the matched ARP table entry can be added to the message to be sent, and the message to be sent can be forwarded from the second network isolation area to the next-hop device according to the outbound interface information in the ARP table entry.

[0079] In some embodiments, after the second message is obtained in the second network isolation area, it can be matched with multiple stored sessions based on the five-tuple information of the second message and the identifier of the first network isolation area. If a session whose five-tuple information and the identifier of the network isolation area are respectively the five-tuple information of the second message and the identifier of the first network isolation area is matched in the multiple stored sessions, the session is determined to be the corresponding session. The corresponding session is obtained, the source and destination MAC addresses stored in the session are added to the second message, and the second message with the added source and destination MAC addresses is forwarded.

[0080] Since the network device is pre-divided into multiple network isolation areas, the session tables in each network isolation area are independent of each other, so for the same five-tuple information, multiple sessions corresponding to the five-tuple information may be stored. In an embodiment of the present application, the session is matched according to the five-tuple information of the message and the identifier of the network isolation area for receiving the first message, that is, the five-tuple information of the message is used to determine the corresponding session in the corresponding network isolation area, so that the session containing the original source and destination MAC addresses of the first message can be accurately obtained, and then the source and destination MAC addresses of the message can be accurately restored.

[0081] The session and the second message can be stored in the memory of the network device, and the session and the second message stored in the memory of the network device can be shared between various network isolation areas. In some embodiments, in the second network isolation area, the second message and the session can be obtained from the memory of the network device. More specifically, in the second network isolation area, the session and the second message can be obtained by reading a specific memory area in the memory of the network device.

[0082] In some embodiments, the network device may pre-store service information, and after acquiring the second message, the second network isolation area may further perform a second process on the second message according to the service information stored in the network device.

[0083] In some embodiments, the network device may pre-store business information, which may include encryption and decryption algorithms (such as SSL algorithms, TLS algorithms, etc.) and encryption and decryption certificates (such as SSL certificates, TLS certificates, etc.). After the second message is obtained in the second network isolation area, the second message may be encrypted according to the encryption and decryption algorithms and encryption and decryption certificates included in the business information. After the source and destination MAC addresses of the second message are restored and the second message is encrypted, the source and destination MAC addresses may be restored and the encrypted second message may be forwarded.

[0084] It is understandable that the embodiments of the present application do not specifically limit the pre-stored service information and the first / second processing performed according to the service information. For example, the service information may be an access control list ACL rule, a quality of service QoS (Quality of Service) policy, etc., and the first / second processing may be processing performed according to the access control list ACL rule, the quality of service QoS, and other information.

[0085] In an embodiment of the present application, when a first message is received in a first network isolation area, the identifier of the first network isolation area, the five-tuple information of the first message, and the source and destination MAC addresses are stored in a session corresponding to the first message, and the session and the second message are stored, wherein the second message is the first message without the source and destination MAC addresses; when the second message is obtained in the second network isolation area, the corresponding session is obtained according to the five-tuple information of the second message and the identifier of the first network isolation area, and the source and destination MAC addresses of the second message are restored and forwarded according to the source and destination MAC addresses stored in the session. By storing the identifier of the network isolation area, the five-tuple information of the message, and the original source and destination MAC addresses in the session corresponding to the message, according to the characteristic that the five-tuple information of the message remains unchanged after the network device with the transparent mode turned on, the five-tuple information of the message is used to query the session in the corresponding network isolation area to obtain the original source and destination MAC addresses of the message, so that when the network device working in the second layer transparent mode is logically divided into multiple network isolation areas, the original source and destination MAC addresses of the message can be restored when sending the message. If the original source and destination MAC addresses of the message can be restored when sending the message, it can ensure that the network equipment can implement effective access control and policies based on the MAC address, and improve the effectiveness and accuracy of network equipment identification and management based on the MAC address.

[0086] like Figure 2A and Figure 2B As shown, Figure 2A and Figure 2B They are respectively a flow chart of the first network isolation area and a flow chart of the second network isolation area provided in an embodiment of the present application.

[0087] The network device is logically divided into multiple network isolation areas in advance and a unique identifier is configured for each network isolation area, and specific functions or services are configured for each network isolation area in advance, wherein the first network isolation area is configured to receive messages from terminal devices, and the second network isolation area is configured to send messages.

[0088] The network device may pre-store message identification information, which may include destination IP, destination port and protocol type.

[0089] like Figure 2A As shown, the first network isolation area can receive a message and determine whether the message is the first message based on the five-tuple information and message identification information of the message.

[0090] If the five-tuple information of the message does not match the message identification information, it is determined that the message is not the first message. In this case, the message is forwarded from the first network isolation area to the next hop device according to the destination MAC address of the message.

[0091] If the quintuple information of the message matches the message identification information, the message is determined to be the first message. In this case, a session corresponding to the first message is created or obtained based on the quintuple information of the first message, and the identifier of the first network isolation area and the quintuple information and source and destination MAC addresses of the message are stored in the session corresponding to the first message.

[0092] The above session and the second message are stored in the memory of the network device, wherein the second message is the first message that does not include the source and destination MAC addresses.

[0093] like Figure 2B As shown, the second network isolation area can obtain the message to be sent, and the above-mentioned message to be sent may include the second message obtained from the network device memory and the message to be sent of the specific function or service pre-configured in the second network isolation area.

[0094] According to the quintuple information and the message identification information of the message to be sent, it is determined whether the message to be sent is the second message, that is, it is determined whether the message to be sent is the second message that needs to restore the source and destination MAC addresses.

[0095] If the message to be sent is not the second message, the ARP table of the second network isolation area is matched according to the destination IP of the message to be sent, the source and destination MAC addresses in the matched ARP table entry are added to the message to be sent, and the message to be sent is forwarded from the second network isolation area to the next hop device according to the outgoing interface information in the ARP table entry.

[0096] If the message to be sent is the second message, an identifier of the first network isolation area for receiving the message is obtained.

[0097] Based on the quintuple information of the second message and the identifier of the first network isolation area, determine whether there is a corresponding session in the session stored in the memory of the network device, that is, determine whether there is a session in the session stored in the memory of the network device whose quintuple information and the identifier of the network isolation area are respectively the quintuple information of the second message and the identifier of the first network isolation area.

[0098] If it does not exist, the ARP table of the second network isolation area is matched according to the destination IP of the second message. If the ARP table entry is matched, the source and destination MAC addresses in the matched ARP table entry are added to the second message, and according to the outbound interface information in the ARP table entry, the second message with the added source and destination MAC addresses is forwarded from the second network isolation area to the next-hop device; if the ARP table entry is not matched, the second message is discarded.

[0099] If it exists, the corresponding session is obtained, and the source and destination MAC addresses stored in the session are added to the message before forwarding.

[0100] In an embodiment of the present application, by saving the identifier of the network isolation area, the five-tuple information of the message and the original source and destination MAC addresses in the session corresponding to the message, and based on the characteristic that the five-tuple information remains unchanged after the message passes through a network device with transparent mode enabled, the five-tuple information of the message is used to query the session in the corresponding network isolation area to obtain the original source and destination MAC addresses of the message, so that when the network device working in the second-layer transparent mode is logically divided into multiple network isolation areas, the original source and destination MAC addresses of the message can be restored when the network device sends the message.

[0101] In some embodiments, the multiple network isolation areas of the network device further include a third network isolation area. When the second network isolation area obtains the second message, the third network isolation area may first obtain the stored second message before obtaining the corresponding session based on the five-tuple information of the second message and the identifier of the first network isolation area.

[0102] When the second message is obtained in the third network isolation area, the source and destination MAC addresses are added to the second message according to the MAC address table in the third network isolation area, and the second message after the source and destination MAC addresses are added is forwarded to the target network device, so that the target network device processes the second message after the source and destination MAC addresses are added;

[0103] After processing the received second message with the added source and destination MAC addresses, the target network device changes the source and destination MAC addresses of the message to send the processed second message to the third network isolation area;

[0104] The third network isolation area can receive the processed second message returned by the target network device, remove the source and destination MAC addresses from the processed second message returned by the target network device, obtain the second message, and store the second message.

[0105] like Figure 3 As shown, Figure 3 It is a flow chart of a message processing method provided by another embodiment of the present application.

[0106] The load device (network device) is logically divided into three network isolation areas, namely network isolation area 1 (first network isolation area), network isolation area 2 (third network isolation area) and network isolation area 3 (second network isolation area).

[0107] Network isolation area 1 is used to receive encrypted messages sent by the client to the server. After network isolation area 1 receives the encrypted message, it decrypts the message according to the SSL algorithm and SSL certificate pre-stored in the load device, and stores the identifier of network isolation area 1, the five-tuple information of the message and the source and destination MAC address in the session corresponding to the message.

[0108] The above session and the decrypted message without the source and destination MAC addresses are stored in the memory of the load device.

[0109] Network isolation zone 2 obtains the decrypted message that does not contain the source and destination MAC addresses stored in network isolation zone 1 from the memory of the load device, adds the source and destination MAC addresses to the message according to the MAC address table in network isolation zone 2, and forwards the message with the added source and destination MAC addresses to the security detection device (target network device), which can be a firewall FW (Firewall), a Web application protection system WAF (Web Application Firewall) or an intrusion prevention system IPS (Intrusion Prevention System) and the like.

[0110] After processing the received message, the security detection device changes the source and destination MAC addresses of the message to send the processed message to the network isolation area 2.

[0111] The network isolation area 2 can receive the processed message returned by the security detection device, remove the source and destination MAC addresses from the processed message returned by the security detection device, and store it in the memory of the load device.

[0112] Network isolation zone 3 obtains the decrypted message that does not contain the source and destination MAC addresses stored in network isolation zone 2 from the memory of the load device, encrypts the message according to the SSL algorithm and SSL certificate pre-stored in the load device, and obtains the corresponding session from the memory of the load device according to the five-tuple information of the message and the identifier of network isolation zone 1, adds the source and destination MAC addresses stored in the session to the message, and then forwards it.

[0113] The above content describes the method provided by the present application. The following describes the device provided by the present application:

[0114] See also Figure 4 , is a structural diagram of a message processing device provided in an embodiment of the present application, the device can be applied to a network device, and the network device is pre-divided into multiple network isolation areas.

[0115] like Figure 4 As shown, the device may include:

[0116] The first processing unit 410 is used for storing, when a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and the five-tuple information and the source and destination MAC addresses of the first message in a session corresponding to the first message, and storing the session and a second message, wherein the second message is the first message that does not include the source and destination MAC addresses;

[0117] The second processing unit 420 is used to determine the corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area when the second network isolation area among the multiple network isolation areas obtains the second message, and restore the source and destination MAC addresses of the second message and then forward it according to the source and destination MAC addresses stored in the determined session.

[0118] In some embodiments, the apparatus further comprises:

[0119] A third processing unit is used for, before the second processing unit 420 performs processing, when the second message is obtained in the third network isolation area, according to the MAC address table in the third network isolation area, adding a source-destination MAC address to the second message, and forwarding the second message after the source-destination MAC address is added to the target network device, so that the target network device processes the second message after the source-destination MAC address is added;

[0120] Receive the processed second message returned by the target network device, and store the second message.

[0121] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0122] The present application embodiment also provides a hardware structure. Figure 5 , Figure 5 This is a structural diagram of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the hardware structure may include: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the method disclosed in the above example of this application.

[0123] Based on the same application concept as the above method, an embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by a processor, the method disclosed in the above example of the present application can be implemented.

[0124] Exemplarily, the above-mentioned machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0125] It should be noted that, in this article, relational terms such as target and target are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0126] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A message processing method, applied to a network device, wherein the network device is pre-divided into a plurality of network isolation areas, characterized in that: The method includes: When a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and five-tuple information and a source-destination MAC address of the first message are stored in a session corresponding to the first message, and the session and a second message are stored, wherein the second message is the first message that does not include the source-destination MAC address; When the second network isolation area among the multiple network isolation areas obtains the second message, the corresponding session is determined according to the quintuple information of the second message and the identifier of the first network isolation area, and the source and destination MAC addresses of the second message are restored and forwarded according to the source and destination MAC addresses stored in the determined session.

2. The method according to claim 1, characterized in that The network device pre-stores message identification information, the message identification information including destination IP, destination port and protocol type, and the method further includes: When a message is received in the first network isolation area, the message is parsed to obtain five-tuple information of the message; Determine whether the five-tuple information of the message matches the message identification information; If there is a match, it is determined that the first message is received; If there is no match, the message is forwarded from the first network isolation area to the next hop device according to the destination MAC address of the message.

3. The method according to claim 1, characterized in that The network device pre-stores message identification information, the message identification information including destination IP, destination port and protocol type, and the method further includes: In the case where the second network isolation area obtains the message to be sent, determining whether the quintuple information of the message to be sent matches the message identification information; If there is a match, it is determined that the second message is obtained; If there is no match, the destination IP of the message to be sent is used to match the Address Resolution Protocol ARP table in the second network isolation area, and according to the matched ARP table entry, the message to be sent is forwarded from the second network isolation area to the next hop device.

4. The method according to claim 1, characterized in that: The network device pre-stores service information, the service information including encryption and decryption algorithms and encryption and decryption certificates, and the method further includes: When the first network isolation area receives the first message, decrypt the first message according to the service information; wherein the second message is the decrypted first message; When the second network isolation area obtains the second message, the second message is encrypted according to the service information.

5. The method according to claim 1, characterized in that The multiple network isolation areas of the network device further include a third network isolation area, and when the second network isolation area among the multiple network isolation areas obtains the second message, before determining the corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area, the method further includes: In the case where the third network isolation area obtains the second message, according to the MAC address table in the third network isolation area, adding the source and destination MAC addresses to the second message, and forwarding the second message after the source and destination MAC addresses are added to the target network device, so that the target network device processes the second message after the source and destination MAC addresses are added; Receive the processed second message returned by the target network device, and store the second message.

6. A message processing device, applied to a network device, wherein the network device is pre-divided into a plurality of network isolation areas, characterized in that: The device includes: A first processing unit, configured to store, when a first network isolation area among the multiple network isolation areas receives a first message, an identifier of the first network isolation area and five-tuple information and a source-destination MAC address of the first message in a session corresponding to the first message, and store the session and a second message, wherein the second message is the first message that does not include the source-destination MAC address; The second processing unit is used to determine the corresponding session according to the quintuple information of the second message and the identifier of the first network isolation area when the second network isolation area among the multiple network isolation areas obtains the second message, and restore the source and destination MAC addresses of the second message according to the source and destination MAC addresses stored in the determined session and then forward it.

7. The device according to claim 6, characterized in that The device also includes: A third processing unit is configured to, before the second processing unit performs processing, add a source-destination MAC address to the second message according to a MAC address table in the third network isolation area when the second message is acquired in the third network isolation area, and forward the second message to which the source-destination MAC address is added to a target network device, so that the target network device processes the second message to which the source-destination MAC address is added; Receive the processed second message returned by the target network device, and store the second message.

8. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor is used to execute the machine executable instructions to implement the method according to any one of claims 1 to 5.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images