Message transmission method and device

Abstract

The invention provides a message transmission method and device which are applied to network security equipment, and the network security equipment comprises a plurality of virtual equipment. The method comprises the following steps: receiving a service message; under the condition that the next hop device of the service message is the first virtual device in the plurality of virtual devices, constructing a virtual link based on a target routing table; the target routing table comprises a route, the route indicates a forwarding path formed by virtual interfaces, and the virtual link is a virtual link between a target incoming interface of the service message and a virtual interface of the first virtual device; and sending the service message to the first virtual device through the virtual link. According to the embodiment of the invention, the virtual link is established between the virtual devices, and cross-virtual device service message transmission is carried out, so that the consumption of physical interface resources is reduced, and the bottleneck of communication of a plurality of virtual devices is broken through.

Description

Technical Field

[0001] The present disclosure belongs to the field of communication technology, and particularly relates to a message transmission method and device. Background Art

[0002] Virtualization technology supports abstracting multiple virtual devices (Context) based on the hardware resources of a physical device. Any virtual device can be logically equivalent to an independent device running a specific service or application, and each virtual device is isolated from each other.

[0003] If the above virtual devices need to transmit service messages, a common solution is to use physical connections to enable the two virtual devices to transmit service messages. In this way, if the needs of multiple virtual devices to transmit service messages to each other are to be met, multiple physical interfaces need to be occupied, and physical interface resources are relatively limited, which can easily become a bottleneck restricting the communication of multiple virtual devices. Summary of the invention

[0004] The present disclosure proposes a message transmission method and device, which configures a virtual interface for each virtual device, and then realizes cross-virtual device message transmission based on the virtual link between the virtual interfaces, which is not only conducive to reducing the consumption of physical interface resources, but also conducive to breaking through the bottleneck of communication between multiple virtual devices.

[0005] A first aspect of the present disclosure provides a message transmission method, which is applied to a network security device, wherein the network security device includes a plurality of virtual devices, and the method includes:

[0006] Receive business messages;

[0007] In the case where the next hop device of the service message is the first virtual device among the multiple virtual devices, a virtual link is constructed based on a target routing table; the target routing table includes a route, the route indicates a forwarding path composed of virtual interfaces, and the virtual link is a virtual link between a target inbound interface of the service message and a virtual interface of the first virtual device;

[0008] The service message is sent to the first virtual device through the virtual link.

[0009] An embodiment of a second aspect of the present disclosure provides a message transmission device, which is applied to a network security device, wherein the network security device includes a plurality of virtual devices, and the device includes:

[0010] A receiving module, used for receiving business messages;

[0011] A construction module, configured to construct a virtual link based on a target routing table when the next hop device of the service message is a first virtual device among the multiple virtual devices; the target routing table includes routes, the routes indicate a forwarding path composed of virtual interfaces, and the virtual link is a virtual link between a target inbound interface of the service message and a virtual interface of the first virtual device;

[0012] A sending module is used to send the service message to the first virtual device through the virtual link.

[0013] An embodiment of the third aspect of the present disclosure provides a network security device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to deploy multiple virtual devices and implement the method described in the first aspect.

[0014] An embodiment of the fifth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect above.

[0015] The technical solution provided in the embodiments of the present disclosure has at least the following technical effects or advantages:

[0016] Virtual interfaces and routing tables are respectively set for the multiple virtual devices included in the network security device in advance, and any routing table includes routing, and the routing indicates the forwarding path composed of virtual interfaces. In this way, in the scenario where the second virtual device included in the network security device receives and forwards the service message to the first virtual device included in the network security device, a virtual link is constructed based on the target routing table corresponding to the second virtual device, and then the service message is sent to the first virtual device through the virtual link. The virtual link is constructed based on the target input interface of the service message and the virtual interface of the first virtual device. It can be seen that the embodiment of the present disclosure, by creating a virtual link between virtual devices and transmitting messages across virtual devices, is not only conducive to reducing the consumption of physical interface resources, but also conducive to breaking through the bottleneck of communication between multiple virtual devices.

[0017] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will become apparent from the following description or be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] By reading the detailed description of the optional embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used to illustrate the purpose of the optional embodiments and are not considered to be limitations of the present disclosure. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.

[0019] In the attached picture:

[0020] Figure 1 A schematic diagram showing the structure of a network system provided by an embodiment of the present disclosure is shown;

[0021] Figure 2 A schematic diagram of a method flow of a message transmission method provided by an embodiment of the present disclosure is shown;

[0022] Figure 3 A schematic diagram showing the structure of a message transmission system provided by an embodiment of the present disclosure is shown;

[0023] Figure 4 A schematic diagram of a scenario of a message transmission scenario provided by an embodiment of the present disclosure is shown;

[0024] Figure 5 A schematic diagram showing the structure of a message transmission device provided by an embodiment of the present disclosure is shown;

[0025] Figure 6 A schematic diagram of the structure of a virtual device provided by an embodiment of the present disclosure is shown;

[0026] Figure 7 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present disclosure should have the common meanings understood by those skilled in the art to which the present disclosure belongs.

[0029] The following introduces the implementation scenarios and related technologies involved in the embodiments of the present disclosure.

[0030] The embodiments of the present disclosure relate to virtualization technology scenarios. Figure 1 The network system shown in the figure, based on the virtualization technology, supports virtualizing several virtual devices (Context) based on the hardware resources of a physical network security device (Device), such as Figure 1Context1, Context2 and Context3 are shown in (1). Context1 can access Local Area Network (LAN) 1, Context2 can access LAN2, and Context3 can access LAN3. In actual implementation scenarios, the network security device can be implemented as a firewall device, for example. In the process of virtualizing Context1, Context2 and Context3 based on the network security device, virtual firewall 1, virtual firewall 2 and virtual firewall 3 can be obtained by configuring the network security device. Virtual firewall 1 can be, for example, the firewall of Context1, virtual firewall 2 can be, for example, the firewall of Context2, and virtual firewall 3 can be, for example, the firewall of Context3. Each firewall can isolate the current Context from other Contexts, so that each Context runs independently of each other, such as Figure 1 As shown in (2) in .

[0031] It should be noted that in a virtualized technical environment, the network security device itself can also be logically equivalent to a virtual device, where the virtual device that is logically equivalent to the network security device itself can be called the "default Context", and Context1, Context2 and Context3 can all be called "non-default Context". Default Context and non-default Context are collectively referred to as virtual devices hereinafter.

[0032] In conventional implementations, communication between any two virtual devices is achieved through physical connections on the network security device, which not only takes up physical resources, but also there is only one network security device with a limited number of physical interfaces, which may not be able to meet the communication needs of multiple virtual devices, thus causing a bottleneck in the communication between multiple virtual devices.

[0033] The technical solution proposed in the embodiment of the present disclosure is to pre-set virtual interfaces for multiple virtual devices respectively, use the multiple virtual interfaces as routing nodes for business message transmission across virtual devices, configure routing tables for forwarding business messages across virtual devices, and support the creation of virtual links based on the virtual interfaces of two virtual devices in the scenario of message transmission across virtual devices, and then transmit business messages across virtual devices through virtual links. In this way, it is not only conducive to reducing the consumption of physical interface resources, but also conducive to breaking through the bottleneck of communication between multiple virtual devices.

[0034] A message transmission method and device proposed according to an embodiment of the present disclosure are described below in combination with the above implementation scenario and the accompanying drawings.

[0035] like Figure 2 As shown, the embodiment of the present disclosure provides a message transmission method, which can be applied to a network security device, and the network security device can be as follows Figure 1 The method includes:

[0036] In step S11, a service message is received.

[0037] The service message is, for example, a message that needs to be transmitted across virtual devices in the network security device. Figure 1 The default Context shown in FIG. 1 receives a service message through a network security device; in some other embodiments, Figure 1 Any non-default Context illustrated in the figure receives the service message through the network security device. For the convenience of description, in this specification, the virtual device that receives the service message among the multiple virtual devices is called the second virtual device.

[0038] In some embodiments, the network security device may receive the service message based on the network to which the second virtual device is connected. In this scenario, the second virtual device is the first forwarding device when the service message is transmitted in the network security device. In other embodiments, the network security device may receive the service message based on other virtual devices in the network security device. In this scenario, the second virtual device is an intermediate forwarding device when the service message is transmitted in the network security device.

[0039] It should be noted that, before step S11, in the stage of configuring the second virtual device, an interface creation instruction may also be received, and a virtual network interface card (vNIC) may be created according to the interface creation instruction, and then the table entry information of the virtual network interface card may be configured to obtain the virtual interface of the second virtual device. The interface creation instruction may be an interface configuration item in the configuration interface of the second virtual device, which is received in response to a user trigger.

[0040] The table entry information of the virtual network interface card may record the status and configuration information of other virtual interfaces connected to the second virtual device, and the table entry information of the virtual network interface card may include at least one of the following: the network address of the virtual network interface card, the status of the virtual network interface card, etc. Exemplarily, the table entry information may include, for example, an Internet Protocol Address (IP address), a Media Access Control address (MAC address), a Maximum Transmission Unit (MTU) size, an interface status, etc. In some embodiments, the network identification portion of the IP address of the virtual interface may indicate the LAN to which the second virtual device is connected, the host identification portion of the IP address of the virtual interface may indicate the second virtual device, and the status of the virtual interface is configured to be an active (up) state.

[0041] It should be understood that the above is only an explanation of configuring a virtual interface using the second virtual device as an example. In some embodiments, when configuring any virtual device, a virtual interface corresponding to the virtual device may be configured accordingly. This will not be repeated here.

[0042] After multiple virtual devices in the network security device are configured with virtual interfaces, the network security device can maintain a correspondence between the virtual interfaces and the devices, where the correspondence includes a correspondence between any virtual device and a corresponding virtual interface.

[0043] In step S12, when the next hop device of the service message is the first virtual device among the multiple virtual devices, a virtual link is constructed based on the target routing table.

[0044] Among them, the first virtual device can be a virtual device other than the second virtual device among the multiple virtual devices. When it is determined that the next-hop device of the service message is the first virtual device, the network security device can determine that the service message needs to be forwarded across virtual devices in the network security device.

[0045] In some embodiments, the first virtual device may be an intermediate forwarding device of the service message. In other embodiments, the first virtual device may be a destination device of the service message.

[0046] The routing table corresponding to the second virtual device is the target routing table. The target routing table includes routes, the routes indicate forwarding paths composed of virtual interfaces, and the virtual link is a virtual link between the target inbound interface of the service message and the virtual interface of the first virtual device. Exemplarily, the forwarding path included in the target routing table consists of the IP address of the virtual interface.

[0047] Combined with the above description, after configuring the virtual interface for each virtual device, a routing table can also be set for each virtual device. The routing table of any virtual device can indicate the IP address of the virtual interface of the virtual device, and the forwarding path composed of the IP addresses of other virtual interfaces connected to the IP address of the virtual interface. The network security device can maintain the correspondence between each virtual device and each routing table, and then, based on these routing tables, the next-hop virtual device of the service message can be determined to ensure that the service message can be correctly forwarded to the destination virtual device.

[0048] It can be seen that the implementation method of this technical solution supports the deployment of virtual interfaces for virtual devices and the generation of cross-virtual device routing tables based on the virtual interfaces of each virtual device, thereby providing an implementation basis for transmitting messages across virtual devices through virtual links.

[0049] It should be noted that the network security device can configure the initial state of each routing table to a static mode. Accordingly, before constructing a virtual link based on the target routing table, the network device can read the destination address of the service message, where the destination address refers to the IP address of the virtual interface corresponding to the destination device of the service message. Afterwards, the next hop device of the service message can be determined as the first virtual device based on the destination address; from the correspondence between the preset routing table and the device, the routing table corresponding to the second virtual device is determined as the target routing table, and the state of the target routing table is switched from a static mode to a dynamic mode.

[0050] It should be understood that the network security device can determine all forwarding devices from the second virtual device to the destination device according to the destination address. Furthermore, in some implementations, the network security device can determine the routing table corresponding to each forwarding device from the correspondence between the preset routing table and the device, and switch the state of the determined routing table from the static mode to the dynamic mode, so as to forward the service message to the corresponding forwarding device, and continue to forward the service message according to the routing table of the corresponding forwarding device.

[0051] Static mode refers to the mode in which the routing table is in an inactive state. In static mode, the routing table does not participate in actual traffic forwarding and does not consume other resources. Dynamic mode refers to the mode in which the routing table is in an active state. In dynamic mode, the routing table can be called to participate in actual traffic forwarding. It can be seen that with this implementation, the initial state of each routing table is static mode. Until there is a traffic match for forwarding service messages, the matching routing table will be activated to a dynamic state, which can not only reduce resource consumption, but also ensure that service messages are forwarded in a timely manner.

[0052] Furthermore, the network security device may determine the target inbound interface and the virtual interface of the first virtual device based on the target routing table, and construct a virtual encryption tunnel between the target inbound interface and the virtual interface of the first virtual device.

[0053] In some embodiments, if the second virtual device is the first forwarding device when the service message is transmitted in the network security device, the second virtual device receives the service message, for example, through the LAN of the second virtual device. Furthermore, by querying the target routing table, the first outbound interface and the second outbound interface of the service message can be determined, and the second outbound interface is the outbound interface of the first outbound interface. According to the corresponding relationship between the virtual interface and the device, it can be determined that the first outbound interface is the virtual interface of the second virtual device, and the second outbound interface is the virtual interface of the first virtual device, then the first outbound interface can be determined as the target inbound interface.

[0054] In some other embodiments, if the second virtual device is an intermediate forwarding device when the business message is transmitted in the network security device, and the second virtual device receives the business message through the virtual interface of the second virtual device, then, by querying the target routing table to determine the outgoing interface of the business message, it can be determined that the outgoing interface corresponds to the first virtual device based on the corresponding relationship between the virtual interface and the device, and then, the virtual interface received by the second virtual device is determined as the target incoming interface.

[0055] Further, the virtual link constructed between the target inbound interface and the virtual interface of the first virtual device may be an unencrypted virtual tunnel or a virtual encrypted tunnel. The unencrypted virtual tunnel may be, for example, based on Software-Defined Networking (SDN) technology, Generic Routing Encapsulation (GRE) tunnel protocol or IP tunnel technology, to create a virtual link between the virtual interface of the second virtual device and the virtual interface of the first virtual device. The virtual encrypted tunnel may be an encrypted tunnel created based on a Virtual Private Network (VPN).

[0056] In step S13, the service message is sent to the first virtual device through the virtual link.

[0057] In the case where the virtual link is an unencrypted virtual tunnel, the second virtual device can configure the virtual interface IP address of the second virtual device as the source IP address of the tunnel, and configure the virtual interface IP address of the first virtual device as the destination IP address of the tunnel, and then encapsulate the service message in a new data packet, the source IP address of the new data packet can be the source IP address of the tunnel, and the destination IP address of the new data packet is the destination IP address of the tunnel. Furthermore, in the network, the service message can be sent to the virtual interface of the first virtual device according to the configuration rules of the corresponding virtual link.

[0058] In the case where the virtual link is an encrypted tunnel, the second virtual device can encrypt the service message using the encryption algorithm and key agreed upon in the stage of configuring the encrypted tunnel, and transmit the encrypted message to the virtual interface of the first virtual device through the encrypted tunnel. Afterwards, the first virtual device decrypts the encrypted message using the decryption algorithm and key agreed upon in the stage of configuring the encrypted tunnel to obtain the service message. This helps to ensure the security of the message in the cross-virtual device transmission scenario.

[0059] Further, after sending the service message to the first virtual device, the network security device may forward the service message based on the routing table corresponding to the first virtual device. The specific implementation method may refer to the description of the above embodiment, which will not be repeated here.

[0060] In some embodiments, after sending the service message to the first virtual device through the virtual link, the network security device may also switch the state of the target routing table from the dynamic mode to the static mode.

[0061] It can be seen that by adopting this implementation method, virtual interfaces and routing tables are respectively set for multiple virtual devices included in the network security device in advance, and any routing table includes routing, and the routing indicates the forwarding path composed of virtual interfaces. In this way, in the scenario where the second virtual device included in the network security device receives and forwards the service message to the first virtual device included in the network security device, a virtual link is constructed based on the target routing table corresponding to the second virtual device, and then the service message is sent to the first virtual device through the virtual link. The virtual link is constructed based on the target input interface of the service message and the virtual interface of the first virtual device. It can be seen that the embodiment of the present disclosure, by creating a virtual link between virtual devices and transmitting messages across virtual devices, is not only conducive to reducing the consumption of physical interface resources, but also conducive to breaking through the bottleneck of communication between multiple virtual devices.

[0062] The technical solution of the embodiment of the present disclosure is described below with reference to examples.

[0063] refer to Figure 3 , Figure 3A structural schematic diagram of a message transmission system is shown, which includes Context30, Context31, Context32 and Context33. Among them, Context30 is a virtual device that is logically equivalent to a network security device (i.e., a physical firewall) in a virtualized environment, and Context30 is the default Context. Context31, Context32 and Context33 are virtual devices created by users based on physical firewalls through virtualization management platforms (such as VMware vSphere, Microsoft Hyper-V, KVM, etc.), and Context31, Context32 and Context33 are all non-default Contexts. Context31 can access LAN31, Context32 can access LAN32, and Context33 can access LAN33. Context31, Context32 and Context33 correspond to a virtual firewall respectively, and are isolated from other Contexts by their respective firewalls.

[0064] Furthermore, users can create virtual interfaces for each Context based on the virtualization management platform. For any Context, users can create a vNIC on the configuration interface of the Context based on the physical interface of the physical firewall, and then configure the table entry of the vNIC to obtain the virtual interface of the Context. For example, the IP address of the vNIC can be configured as mmmx / 24, where mmmx is the network identifier of the LAN to which the Context is connected. The physical layer and link layer of the vNIC are configured to be up.

[0065] Reference again Figure 3 , Figure 3 The blocks in each Context shown in the figure are virtual interfaces of the corresponding Context. The correspondence between each Context and the virtual interface can be shown in Table 1. The user can send the correspondence shown in Table 1 to each Context through the virtualization management platform.

[0066] Table 1

[0067] Context Virtual Interface Context30 Virtual interface 30 Context31 Virtual interface 31 Context32 Virtual interface 32 Context33 Virtual interface 33

[0068] It should be noted that the virtual interface of any context can be connected to the virtual firewall of the context.

[0069] Furthermore, for any Context, a routing table corresponding to the Context can be constructed based on the virtual interface of the Context and the virtual interfaces of other Contexts. The routing table of the Context includes a route, which indicates a forwarding path composed of the IP address of the virtual interface of the Context and the IP address of the virtual interface of another Context. For example, taking Context32 as an example, the route contained in the routing table corresponding to Context32 indicates, for example, the forwarding path between virtual interface 32 and virtual interface 30. Among them, the initial state of the routing table of each of the above Contexts is static mode.

[0070] Taking LAN31 receiving a service message and transmitting the service message to Context30 as an example, the virtual firewall of Context31 (i.e., the aforementioned second virtual device) receives the service message from LAN31, and the destination address included in the service message is, for example, the IP address of the virtual interface 30. The network security device can determine, for example, that the next-hop device of the service message is Context32 (i.e., the aforementioned first virtual device) based on the IP address of the destination address virtual interface 30, and further, can determine the routing tables corresponding to Context31, Context32, and Context30 respectively from the correspondence between the preset routing tables and the devices, and switch the states of the determined routing tables from the static mode to the dynamic mode.

[0071] After the state of the routing table of Context31 (i.e., the above-mentioned target routing table) is switched from static mode to dynamic mode, it can be determined according to the routing table that the next-hop forwarding node of the service message is virtual interface 31 (i.e., the above-mentioned first outgoing interface), and the next-hop forwarding node of virtual interface 31 is virtual interface 32 (i.e., the above-mentioned second outgoing interface). Furthermore, the service message can be forwarded to virtual interface 31, and then a virtual link between virtual interface 31 and virtual interface 32 is constructed, and the service message is sent to virtual interface 32 through the virtual link. Further, it can be determined by querying the routing table of Context32 that the next-hop forwarding node (i.e., outgoing interface) of the service message is virtual interface 30, and then a virtual link between virtual interface 32 and virtual interface 30 is constructed, and the service message is sent to virtual interface 30 through the virtual link.

[0072] Among them, the virtual link between two virtual devices can be as follows Figure 4Taking virtual device 31 and virtual device 30 as an example, the virtual firewall of Context31 can build a virtual link between virtual interface 31 and virtual interface 30, connect Context31 with Context30 through the virtual link, and then send the service message from virtual interface 31 to virtual interface 30 through the virtual link to realize the transmission of the service message from Context31 to Context30.

[0073] It should be understood that Figure 3 The message transmission system and the related forwarding path shown are schematic implementations of the present disclosure and do not limit the implementation of the embodiments of the present disclosure. In some other implementations, the message transmission system may also include more or fewer contexts, and the implementation of the routing table may also be flexibly configured according to the implementation scenario.

[0074] In summary, the message transmission method involved in the embodiment of the present disclosure sets virtual interfaces and routing tables for multiple virtual devices included in the network security device in advance, and any routing table includes routing, and the routing indicates the forwarding path composed of virtual interfaces. In this way, in the scenario where the second virtual device included in the network security device receives and forwards the service message to the first virtual device included in the network security device, a virtual link is constructed based on the target routing table corresponding to the second virtual device, and then the service message is sent to the first virtual device through the virtual link. The virtual link is constructed based on the target input interface of the service message and the virtual interface of the first virtual device. It can be seen that the embodiment of the present disclosure, by creating a virtual link between virtual devices and transmitting messages across virtual devices, is not only conducive to reducing the consumption of physical interface resources, but also conducive to breaking through the bottleneck of communication between multiple virtual devices.

[0075] The present disclosure also provides a message transmission device, which can be deployed in a network security device (i.e., the aforementioned physical firewall) to perform the operations of the message transmission method described in any of the above embodiments, such as Figure 5 As shown, the device comprises:

[0076] Receiving module 501, used for receiving service messages;

[0077] A construction module 502 is used to construct a virtual link based on a target routing table when the next hop device of the service message is the first virtual device among the multiple virtual devices; the target routing table includes routes, the routes indicate a forwarding path composed of virtual interfaces, and the virtual link is a virtual link between a target inbound interface of the service message and a virtual interface of the first virtual device;

[0078] The sending module 503 is used to send the service message to the first virtual device through the virtual link.

[0079] In an embodiment of the present disclosure, the forwarding path included in the target routing table is composed of the IP address of the virtual interface, and the device also includes a reading module, a determination module and a state switching module, wherein the reading module is used to read the destination address of the service message, and the destination address refers to the IP address of the virtual interface corresponding to the destination device of the service message; the determination module is used to determine that the next-hop device of the service message is the first virtual device according to the destination address; the state switching module is used to determine the routing table corresponding to the second virtual device as the target routing table from the correspondence between the preset routing table and the device, and switch the state of the target routing table from the static mode to the dynamic mode, and the second virtual device is the device that receives the service message among the multiple virtual devices.

[0080] In the embodiment of the present disclosure, the determination module is also used to determine the target input interface and the virtual interface of the first virtual device based on the target routing table; the construction module 502 is also used to construct a virtual encryption tunnel between the target input interface and the virtual interface of the first virtual device.

[0081] In an embodiment of the present disclosure, if the second virtual device is the first forwarding device when the business message is transmitted in the network security device, the device also includes a query module, wherein the query module is used to query the target routing table to determine the first outbound interface and the second outbound interface of the business message, and the second outbound interface is the outbound interface of the first outbound interface; the determination module is also used to determine, based on the correspondence between the virtual interface and the device, that the first outbound interface is the virtual interface of the second virtual device, and the second outbound interface is the virtual interface of the first virtual device; and determine the first outbound interface as the target inbound interface.

[0082] In the embodiment of the present disclosure, the query module is also used to query the target routing table to determine the outgoing interface of the service message if the second virtual device is an intermediate forwarding device when the service message is transmitted in the network security device; the determination module is also used to determine that the outgoing interface corresponds to the first virtual device based on the corresponding relationship between the virtual interface and the device, and to determine the virtual interface received by the second virtual device as the target inbound interface.

[0083] In the embodiment of the present disclosure, the state switching module is further used to switch the state of the target routing table from the dynamic mode to the static mode after sending the service message to the first virtual device through the virtual link.

[0084] The message transmission device provided in the above-mentioned embodiment of the present disclosure and the message transmission method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0085] The disclosed embodiment also provides a network security device to execute the message transmission method. Figure 6 , which shows a schematic diagram of a network security device provided by some embodiments of the present disclosure. Figure 6 As shown, the network security device 6 includes: a processor 600, a memory 601, a bus 602 and a communication interface 603, wherein the processor 600, the communication interface 603 and the memory 601 are connected via the bus 602; the memory 601 stores a computer program that can be run on the processor 600, and when the processor 600 runs the computer program, it executes the message transmission method provided in any of the aforementioned embodiments of the present disclosure.

[0086] The memory 601 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the virtual devices of the system is realized through at least one communication interface 603 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0087] The bus 602 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 601 is used to store programs, and the processor 600 executes the programs after receiving execution instructions. The message transmission method disclosed in any implementation of the aforementioned embodiment of the present disclosure may be applied to the processor 600, or implemented by the processor 600.

[0088] The processor 600 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 600 or the instruction in the form of software. The above processor 600 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 601, and the processor 600 reads the information in the memory 601 and completes the steps of the above method in combination with its hardware.

[0089] The electronic device provided by the embodiment of the present disclosure and the message transmission method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by them.

[0090] The present disclosure also provides a computer-readable storage medium corresponding to the message transmission method provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD 70 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the message transmission method provided by any of the aforementioned embodiments will be executed.

[0091] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0092] The computer-readable storage medium provided by the above-mentioned embodiments of the present disclosure and the message transmission method provided by the embodiments of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0093] Although the optional embodiments of the present application have been described, those skilled in the art, once informed of the basic creative concept, may make additional changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications falling within the scope of the present application.

[0094] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation method of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present invention.

Claims

1. A message transmission method, characterized in that: Applied to a network security device, the network security device includes a plurality of virtual devices, the method includes: Receive business messages; In the case where the next hop device of the service message is the first virtual device among the multiple virtual devices, a virtual link is constructed based on a target routing table; the target routing table includes a route, the route indicates a forwarding path composed of virtual interfaces, and the virtual link is a virtual link between a target inbound interface of the service message and a virtual interface of the first virtual device; The service message is sent to the first virtual device through the virtual link.

2. The method according to claim 1, characterized in that The forwarding path included in the target routing table is composed of the Internet Protocol IP address of the virtual interface. Before the virtual link is constructed based on the target routing table, the following is also included: Reading the destination address of the service message, where the destination address refers to the IP address of the virtual interface corresponding to the destination device of the service message; Determine, according to the destination address, that the next hop device of the service message is the first virtual device; From the correspondence between the preset routing table and the device, determine the routing table corresponding to the second virtual device as the target routing table, switch the state of the target routing table from static mode to dynamic mode, and the second virtual device is the device among the multiple virtual devices that receives the service message.

3. The method according to claim 1 or 2, characterized in that: The step of constructing a virtual link based on the target routing table includes: Determine the target inbound interface and the virtual interface of the first virtual device based on the target routing table; A virtual encryption tunnel is constructed between the target inbound interface and the virtual interface of the first virtual device.

4. The method according to claim 3, characterized in that If the second virtual device is the first forwarding device when the service message is transmitted in the network security device, determining the target inbound interface and the virtual interface of the first virtual device based on the target routing table includes: Query the target routing table to determine a first outbound interface and a second outbound interface of the service message, where the second outbound interface is an outbound interface of the first outbound interface; According to the correspondence between the virtual interface and the device, determining that the first output interface is the virtual interface of the second virtual device, and the second output interface is the virtual interface of the first virtual device; The first outbound interface is determined as the target inbound interface.

5. The method according to claim 3, characterized in that: If the second virtual device is an intermediate forwarding device when the service message is transmitted in the network security device, determining the target inbound interface and the virtual interface of the first virtual device based on the target routing table includes: Query the target routing table to determine the outgoing interface of the service message; According to the correspondence relationship between the virtual interface and the device, it is determined that the outgoing interface corresponds to the first virtual device, and the virtual interface received by the second virtual device is determined as the target incoming interface.

6. The method according to claim 2, characterized in that After sending the service message to the first virtual device through the virtual link, the method further includes: The state of the target routing table is switched from the dynamic mode to the static mode.

7. A message transmission device, characterized in that: Applied to a network security device, the network security device includes a plurality of virtual devices, and the apparatus includes: A receiving module, used for receiving business messages; A construction module, configured to construct a virtual link based on a target routing table when the next hop device of the service message is a first virtual device among the multiple virtual devices; the target routing table includes routes, the routes indicate a forwarding path composed of virtual interfaces, and the virtual link is a virtual link between a target inbound interface of the service message and a virtual interface of the first virtual device; A sending module is used to send the service message to the first virtual device through the virtual link.

8. The device according to claim 7, characterized in that The forwarding path included in the target routing table is composed of the Internet Protocol IP address of the virtual interface, and the device also includes a reading module, a determination module and a state switching module, wherein: The reading module is used to read the destination address of the service message, where the destination address refers to the IP address of the virtual interface corresponding to the destination device of the service message; The determining module is used to determine that the next hop device of the service message is the first virtual device according to the destination address; The state switching module is used to determine the routing table corresponding to the second virtual device as the target routing table from the correspondence between the preset routing table and the device, and switch the state of the target routing table from a static mode to a dynamic mode. The second virtual device is the device among the multiple virtual devices that receives the business message.

9. The device according to claim 7 or 8, characterized in that The determination module is further configured to determine the target inbound interface and the virtual interface of the first virtual device based on the target routing table; The construction module is further used to construct a virtual encryption tunnel between the target input interface and the virtual interface of the first virtual device.

10. The device according to claim 9, characterized in that If the second virtual device is the first forwarding device when the service message is transmitted in the network security device, the apparatus further includes a query module, wherein: The query module is used to query the target routing table to determine a first outbound interface and a second outbound interface of the service message, where the second outbound interface is the outbound interface of the first outbound interface; The determination module is further used to determine, based on the correspondence between the virtual interface and the device, that the first output interface is the virtual interface of the second virtual device and the second output interface is the virtual interface of the first virtual device; and determine the first output interface as the target input interface.

11. The device according to claim 10, characterized in that The query module is further configured to query the target routing table to determine the outgoing interface of the service message if the second virtual device is an intermediate forwarding device when the service message is transmitted in the network security device; The determination module is further configured to determine, based on a correspondence between virtual interfaces and devices, that the outgoing interface corresponds to the first virtual device, and to determine the virtual interface received by the second virtual device as the target incoming interface.

12. The device according to claim 8, characterized in that The state switching module is further configured to switch the state of the target routing table from the dynamic mode to the static mode after sending the service message to the first virtual device through the virtual link.

Images