Agile networking technology combining virtual tunnel with network forwarding

Abstract

The invention relates to the technical field of network communication and security, and discloses an agile networking technology combining a virtual tunnel with network forwarding, which comprises the following steps: generating a public and private key pair on security gateway equipment of a site, and sending a public key to a controller; the controller receives security gateway public key information of a plurality of sites and generates virtual tunnel configuration information, and the configuration information comprises an IP address of an opposite-end security gateway, an opposite-end public key and a tunnel IP address; the controller issues the generated virtual tunnel configuration information to a security gateway of each station, and the security gateway establishes a virtual tunnel based on the configuration information; the security gateway is internally provided with a probe module, detects the accessibility of a local network regularly, and transmits detection information to the controller. According to the method, tunnel configuration can be completed according to the tunnel IP address and opposite-end public key information, the tunnel IP address can be used for virtual tunnels established with different opposite-end security gateways, the expansibility of the tunnel IP address is not limited by the number of the IP addresses, and full-interconnection virtual tunnel networking can be supported.

Description

Technical Field

[0001] The present invention relates to the field of network communication and security technology, and in particular to an agile networking technology combining a virtual tunnel with network forwarding. Background Art

[0002] As a mature technology, virtual tunnels are widely used in networking different sites. The core principle is to use the existing Internet exit to create a virtual "dedicated line" to connect unconnected sites to form a large local area network. This technology plays a vital role in building secure and private network communications, and is therefore widely used in scenarios such as enterprises and organizations that require cross-regional networking.

[0003] In the prior art, many different virtual tunnel technologies have been developed and used, among which IPSEC (Internet Protocol Security) is the most widely used. IPSEC defines a complete set of security standard frameworks to ensure confidential and secure communications on IP networks by using encrypted security services. IPSEC not only provides end-to-end encryption for public and private networks, but also provides authentication services for both parties in communication to ensure that data is not tampered with or stolen during transmission. Therefore, IPSEC is considered to be a very powerful virtual tunnel technology and is widely used, especially in network environments that require high security requirements.

[0004] However, despite its powerful functions, IPSEC is relatively complex to configure. When traditional IPSEC-based virtual tunnel technology is used to establish a "site" to "site" connection between different sites, it is usually necessary to configure the information of the other end at both ends. This configuration information usually includes the IP address of the other end, the tunnel mode, the asymmetric encryption algorithm used for IKE (Internet Key Exchange), the one-way hash encryption algorithm, the symmetric encryption algorithm used for network forwarding, and the shared key. Especially in a multi-site environment, when multiple sites need to be interconnected, the complexity and workload of the configuration will increase exponentially. In addition, IPSEC forwards the network based on "interest flow" or routing. Its mechanism requires the pre-definition of the target network range that needs to be forwarded through the virtual tunnel, but it has no perception of the network status of the receiving end. This will cause unnecessary network traffic to pass through the virtual tunnel, increase the forwarding pressure of the network tunnel, and may even cause network congestion problems.

[0005] In contrast, Wi reguard is an emerging virtual tunnel technology known for its security, simplicity and high performance. Wi reguard was originally designed to simplify the configuration and management of virtual tunnels, so its configuration process is simpler than IPSEC. However, Wi reguard itself only defines the data plane forwarding technology and does not provide a specific definition of how to manage and establish virtual tunnels. Therefore, although Wi reguard performs well in data transmission efficiency and security, its management and expansion capabilities are limited in complex multi-site networking scenarios.

[0006] Traditional IPSEC-based virtual tunnel technology requires pre-definition of "interest flows" or routing configuration of the target network range that needs to be forwarded through the virtual tunnel, which not only makes the configuration process complicated, but also requires network administrators to have a high level of understanding of the protocol itself and cryptography. In addition, different sites have no ability to perceive the network status of the other end, resulting in the inability to automatically filter unnecessary data packets based on the reachability of the target, which may cause the risk of network congestion. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention provides an agile networking technology combining a virtual tunnel with network forwarding, which solves the problems in the prior art of complex virtual tunnel configuration, lack of real-time perception of network conditions and low network forwarding efficiency.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: an agile networking technology combining virtual tunnels with network forwarding, including:

[0009] Generate a public-private key pair on the site's security gateway device and send the public key to the controller;

[0010] The controller receives the public key information of the security gateways of the multiple sites and generates virtual tunnel configuration information, wherein the configuration information includes the IP address of the peer security gateway, the peer public key and the tunnel IP address;

[0011] The controller sends the generated virtual tunnel configuration information to the security gateway of each site, and the security gateway establishes a virtual tunnel based on the configuration information;

[0012] The security gateway has a built-in probe module that regularly detects the reachability of the local network and transmits the detection information to the controller;

[0013] The controller updates the network forwarding table based on the probe information and sends the updated forwarding table to the security gateway.

[0014] Preferably, the probe module can detect the subnet and host of the network, and can detect service status information based on the application layer protocol, and feed back this information to the controller.

[0015] Preferably, the controller adjusts the network forwarding table of the virtual tunnel according to the received probe information to optimize the network traffic distribution of the tunnel.

[0016] Preferably, the virtual tunnel is based on the Wi reguard protocol and adopts the encryption and decryption mechanism of the Wi reguard protocol.

[0017] Preferably, the encryption and decryption algorithm can be replaced with a national encryption algorithm to adapt to different encryption requirements.

[0018] Preferably, the security gateway device communicates with the controller via the Internet, and the communication between the controller and the security gateway uses encrypted tunnel technology.

[0019] Preferably, the controller is implemented in a cluster management mode consisting of multiple controllers, each controller in the cluster can generate and manage virtual tunnel configuration information, and when any controller fails, the management function will be taken over by other controllers.

[0020] Preferably, the controller cluster mode supports information synchronization between controllers, including tunnel configuration information, probe detection results, and network forwarding table information.

[0021] Preferably, the controller dynamically allocates detection tasks to each security gateway according to the network topology and real-time probe information.

[0022] Preferably, the probe detection task includes using ICMP, ARP, HTTP protocols to detect the reachability of the target subnet and IP address, and the detection result is used to adjust the network forwarding strategy of the virtual tunnel in real time.

[0023] The present invention provides an agile networking technology combining virtual tunnels with network forwarding. It has the following beneficial effects:

[0024] 1. The present invention centrally manages the configuration information of the virtual tunnel through the controller. Your invention significantly simplifies the tunnel configuration process. Compared with the traditional IPSEC tunnel configuration, the present invention only needs to configure a small amount of key information to complete the tunnel establishment. This not only reduces the configuration time, but also reduces the risk of errors, and is particularly suitable for large-scale networking scenarios with multiple sites.

[0025] 2. Through the real-time network detection of the probe module and the dynamic forwarding table update function of the controller, your invention can optimize the data transmission path in real time according to the latest network status and ensure that the data packet is transmitted through the best path. This reduces unnecessary network traffic, avoids network congestion in the tunnel, and improves network transmission efficiency.

[0026] 3. The IP address in the tunnel configuration of the present invention can establish connections with multiple peer security gateways, which makes your invention not limited by the number of IP addresses in terms of scalability, can adapt to larger-scale network interconnection needs, and is suitable for complex and large-scale network environments.

[0027] 4. Through the introduction of the probe module, the present invention enables each security gateway to have real-time network perception capabilities. The controller can quickly adjust the network forwarding strategy based on the information fed back by the probe, thereby ensuring that the data flow can adapt to changes in the network status in a timely manner, which not only improves the response speed of the network, but also improves the reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] Example:

[0031] Please see attached Figure 1 The embodiment of the present invention provides an agile networking technology combining a virtual tunnel with network forwarding, including:

[0032] 1. Implementation of system architecture

[0033] 1.1 Controller deployment and configuration

[0034] In this embodiment, the controller is designed as the core management component of the network architecture. The controller can be deployed on any server with Internet access capability. Its main function is to generate and send virtual tunnel configuration information and update the network forwarding table in real time. Through this centralized management mechanism, the configuration process of the virtual tunnel is simplified and the network security risks caused by configuration errors are reduced.

[0035] Controller configuration: In this embodiment, when the controller is first deployed, it pre-configures the communication parameters between each security gateway, such as the IP address and access key of the security gateway, to ensure that the controller can establish a secure connection with each security gateway. The controller contains a routing table generation module, which dynamically generates a network forwarding table based on the feedback information received from the network probe. This configuration method simplifies the overall system settings, reduces the configuration difficulty in complex network environments, and facilitates large-scale deployment.

[0036] 1.2 Deployment and Functions of Security Gateway

[0037] In this embodiment, the security gateway is deployed between each site that needs to be interconnected, for the creation of virtual tunnels and the encryption and forwarding of data. Each security gateway is integrated with a probe module for real-time detection of network accessibility. Through this design, the perception of network conditions by each site is enhanced, so that the response speed and reliability of the network are improved.

[0038] Configuration of the security gateway: At each site, the security gateway needs to perform security authentication with the controller. The authentication process includes generating a public-private key pair and sending the public key to the controller. In this embodiment, this authentication mechanism ensures the security of the virtual tunnel, while avoiding redundant configuration work in a complex multi-site environment and simplifying network deployment.

[0039] 1.3 Built-in probe module

[0040] In this embodiment, the probe module, as the core functional module of the security gateway, is responsible for real-time detection of the network status of the local site. The probe module regularly scans the subnets and hosts within the site through various methods (such as ICMP, ARP, HTTP), and uploads the reachability information to the controller in real time. This real-time feedback mechanism enables the network to be optimized according to the latest network status, significantly reducing delays caused by network congestion or invalid paths.

[0041] Configuration and operation of the probe: When the probe module is first run, the controller will issue a detection task, which includes the subnet range to be detected, the target IP address list, and the detection method. In this embodiment, the probe module sends detection packets regularly based on these tasks and records the response time and reachability of the target. Through real-time detection and reporting, it ensures that the network forwarding table can be updated in time, effectively improving the transmission efficiency of the network and reducing unnecessary load in the network.

[0042] 2. Establishment of virtual tunnel

[0043] 2.1 Security Gateway Key Generation and Exchange

[0044] In this embodiment, the security gateway ensures the security of the tunnel by generating a public-private key pair and exchanges public keys with the peer security gateway to establish a secure virtual tunnel. This key generation and exchange mechanism not only improves the security of network transmission, but also maintains the confidentiality of the tunnel.

[0045] Generation of public and private keys: In the early stage of tunnel establishment, the security gateway generates a pair of public and private keys through the built-in encryption module. The private key is used to encrypt local data, while the public key is used to exchange data with the peer security gateway. This process ensures the encrypted transmission of data in the tunnel and avoids the risk of data being intercepted by unauthorized third parties.

[0046] Key exchange: In this embodiment, the security gateway sends the generated public key to the controller through a secure channel, and the controller stores this key and the public keys of other sites in the routing table. When a new tunnel needs to be established, the controller sends the public key of the other end to the local security gateway and generates the corresponding tunnel configuration. In this way, tunnel establishment is not only fast and secure, but also reduces the complexity and error risk of manual configuration.

[0047] 2.2 Generation and Distribution of Tunnel Configuration Information

[0048] In this embodiment, the controller generates virtual tunnel configuration information based on the preset network topology and the network reachability information fed back by the probe, and sends it to the security gateway. Through this centralized management approach, the tunnel configuration process becomes more concise and efficient.

[0049] Generation of tunnel configuration information: Based on the network status fed back by the probe, the controller generates tunnel configuration information including the following contents: the IP address of the peer security gateway, the virtual tunnel IP addresses of the local and peer ends, the public key used for encryption, etc. In this embodiment, the controller also generates the network range that needs to be forwarded through the tunnel based on the overall topology of the network. This configuration method not only improves the scalability of the tunnel, but also simplifies tunnel management in a multi-site environment.

[0050] Sending tunnel configuration information: In this embodiment, after generating configuration information, the controller sends the configuration information to each relevant security gateway through an encrypted control channel. After receiving the configuration, the security gateway can establish a virtual tunnel and prepare for data transmission. The centralized control tunnel configuration mechanism reduces the complexity of network configuration while ensuring the consistency and security of network configuration.

[0051] 3. Management and update of network forwarding table

[0052] 3.1 Periodic detection and reporting of the probe module

[0053] In this embodiment, the probe module periodically detects the network reachability of the local site according to the tasks issued by the controller, and reports in real time when the detection results change. This periodic detection mechanism ensures real-time updates of the network status, allowing network traffic to dynamically adapt to changes in the network environment, thereby improving the response speed of the overall network.

[0054] Execution of detection tasks: The probe module uses ICMP packets to detect the survival status of hosts in the subnet according to the tasks assigned by the controller, uses ARP packets to obtain device information of the local network, and detects the service availability of the specified IP address through HTTP. In this embodiment, the probe module records the results of each detection and uploads them to the controller. Through this mechanism, the network can quickly adapt to the changing network status, effectively reducing unnecessary traffic forwarding and reducing network load.

[0055] Generation of detection reports: In this embodiment, when the probe detects a change in network status (such as an unreachable IP address), a detection report is immediately generated and uploaded to the controller through an encrypted channel. After receiving the detection report, the controller updates the network forwarding table according to the new network status. This real-time update mechanism significantly reduces the delay caused by invalid paths or network congestion, and improves the efficiency and stability of network transmission.

[0056] 3.2 Controller network forwarding table update

[0057] In this embodiment, the controller dynamically updates the network forwarding table based on the network reachability information fed back by the probe, and sends the updated forwarding table to each security gateway to ensure that data packets are transmitted only through valid paths. Through this mechanism, network traffic can be dynamically allocated to the best path, thereby avoiding unnecessary network congestion and improving the overall performance of the network.

[0058] Generation of network forwarding table: In this embodiment, the controller generates a global network topology map by integrating the detection information fed back by all security gateways. Based on the topology map, the controller dynamically adjusts the content of the network forwarding table to ensure that each security gateway can perform efficient routing forwarding according to the latest network conditions. Through this mechanism, the network can quickly respond to changes in the network environment and maintain the efficiency and stability of data transmission.

[0059] Sending of network forwarding table: In this embodiment, after generating a new forwarding table, the controller sends it to all relevant security gateways through an encrypted control channel. After receiving the updated forwarding table, the security gateway immediately applies the new forwarding strategy to ensure the optimal transmission path of network traffic. This real-time update mechanism not only ensures the efficient operation of the network, but also effectively reduces the data packet loss phenomenon in the network.

[0060] In this embodiment, the configuration information of the virtual tunnel is centrally managed by the controller, which significantly simplifies the tunnel configuration process. Compared with the traditional IPSEC tunnel configuration, the present invention only needs to configure a small amount of key information to complete the tunnel establishment, effectively reducing the configuration time and error rate, especially in the case of multi-site networking, it can significantly improve the networking efficiency. This mechanism not only reduces the complexity of technical implementation, but also makes large-scale network deployment more feasible and efficient.

[0061] In this embodiment, the real-time network detection of the probe module and the dynamic forwarding table update function of the controller ensure that the data packets can be transmitted through the best path, avoiding unnecessary network traffic passing through the congested tunnel. This design greatly reduces network congestion in the tunnel, improves the transmission efficiency of the entire network, reduces network latency, and improves user experience.

[0062] In this embodiment, although the controller is responsible for the configuration and forwarding management of the tunnel, it does not directly participate in the generation of public and private keys and the exchange of encrypted data, ensuring that the security of the tunnel is not affected by the controller. In addition, the design of the present invention allows the tunnel IP address to establish connections with multiple peers, so that the scalability of the tunnel is not limited by the number of IP addresses and can adapt to large-scale network interconnection needs. This flexible configuration method enables the present invention to be applied to various complex network environments and has a wide range of applicability.

[0063] In this embodiment, the introduction of the probe module enables each security gateway to have real-time network perception capabilities. Through the information fed back by the probe, the controller can quickly adjust the forwarding strategy to ensure that network traffic can adapt to changes in network status in a timely manner, further improving the response speed and reliability of the network. This mechanism is particularly suitable for scenarios that require highly dynamic network management, such as corporate intranets, multi-site networks distributed across regions, etc.

[0064] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An agile networking technology combining virtual tunnels with network forwarding, characterized in that: include: Generate a public-private key pair on the site's security gateway device and send the public key to the controller; The controller receives the public key information of the security gateways of the multiple sites and generates virtual tunnel configuration information, wherein the configuration information includes the IP address of the peer security gateway, the peer public key and the tunnel IP address; The controller sends the generated virtual tunnel configuration information to the security gateway of each site, and the security gateway establishes a virtual tunnel based on the configuration information; The security gateway has a built-in probe module that regularly detects the reachability of the local network and transmits the detection information to the controller; The controller updates the network forwarding table based on the probe information and sends the updated forwarding table to the security gateway.

2. According to claim 1, the agile networking technology combining virtual tunnel and network forwarding is characterized in that: The probe module can detect the subnet and host of the network, and can detect the service status information based on the application layer protocol, and feed back the information to the controller.

3. According to claim 1, the agile networking technology combining virtual tunnel and network forwarding is characterized in that: The controller adjusts the network forwarding table of the virtual tunnel according to the received probe information, and optimizes the network traffic distribution of the tunnel.

4. According to claim 1, the agile networking technology combining virtual tunnel and network forwarding is characterized in that: The virtual tunnel is based on the Wireguard protocol and adopts the encryption and decryption mechanism of the Wireguard protocol.

5. The agile networking technology of combining virtual tunnel with network forwarding according to claim 4 is characterized in that: The encryption and decryption algorithm can be replaced with a national encryption algorithm to meet different encryption requirements.

6. The agile networking technology of combining virtual tunnel with network forwarding according to claim 1, characterized in that: The security gateway device communicates with the controller via the Internet, and the communication between the controller and the security gateway uses encrypted tunnel technology.

7. The agile networking technology of combining virtual tunnel with network forwarding according to claim 1, characterized in that: The controller is implemented in a cluster management mode consisting of multiple controllers. Each controller in the cluster can generate and manage virtual tunnel configuration information, and when any controller fails, the other controllers will take over the management function.

8. The agile networking technology combining virtual tunnel and network forwarding according to claim 1, characterized in that: The controller cluster mode supports information synchronization between controllers, including tunnel configuration information, probe detection results, and network forwarding table information.

9. The agile networking technology combining virtual tunnel and network forwarding according to claim 1, characterized in that: The controller dynamically distributes detection tasks to each security gateway according to the network topology and real-time probe information.

10. The agile networking technology combining virtual tunnel and network forwarding according to claim 9, characterized in that: The probe detection task includes using ICMP, ARP, and HTTP protocols to detect the reachability of the target subnet and IP address, and the detection results are used to adjust the network forwarding strategy of the virtual tunnel in real time.

Images