Method and system for mobile terminal accessing SD-WAN network

Abstract

This specification relates to the field of communication technology, and in particular to a method and system for a mobile terminal to access an SD-WAN network. The method includes: an SD-WAN controller receives a connection request from a mobile terminal; the SD-WAN controller generates connection information according to the connection request, and sends the connection information to an access PoP node to perform tunnel routing configuration; the SD-WAN controller sends tunnel access information to the mobile terminal, so that the mobile terminal accesses the access PoP node according to the tunnel access information; after the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE. End-to-end control from the mobile terminal to the target CPE in the SD-WAN tunnel link can be achieved, making communication more stable and secure.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and system for a mobile terminal to access an SD-WAN network. Background Art

[0002] Traditional wide area networks (WANs) usually rely on dedicated hardware devices and fixed circuits (such as MPLS). These network architectures have problems such as complex configuration, poor scalability and high costs. Especially as enterprises transform to cloud computing and mobile office, the limitations of traditional WANs are becoming more and more obvious, including difficulty in coping with dynamic traffic patterns, lack of support for real-time applications and long deployment cycles. In addition, traditional WANs often require different equipment to be configured at each station, which increases management complexity and operation and maintenance costs.

[0003] SD-WAN (Software Defined Wide Area Network) came into being to solve these problems. It abstracts the underlying network hardware and uses software-defined networking (SDN) technology to achieve more flexible and efficient network management. SD-WAN provides a centralized control platform that allows administrators to remotely manage network policies and traffic paths through software, simplifying network configuration and operation and maintenance. Compared with traditional WAN, SD-WAN can dynamically select the best network path to improve network reliability and resource utilization. In addition, SD-WAN supports multiple transmission methods (such as the Internet, dedicated lines, and LTE), enabling enterprises to improve application performance and agility while reducing costs. These advantages have prompted more and more companies to turn to SD-WAN from traditional network architecture to support their digital transformation and cloud application needs.

[0004] How to enable mobile terminals to connect to the SD-WAN network more stably and securely is an issue that needs to be addressed urgently. Summary of the invention

[0005] In order to solve the problems in the prior art, the embodiments of this specification provide a method and system for a mobile terminal to access an SD-WAN network, which solves the problem in the prior art that a mobile terminal can be connected to an SD-WAN network more stably and securely.

[0006] The embodiment of this specification provides a method for a mobile terminal to access an SD-WAN network, including:

[0007] The SD-WAN controller receives the connection request from the mobile terminal;

[0008] The SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration;

[0009] The SD-WAN controller sends tunnel access information to the mobile terminal, so that the mobile terminal accesses the access PoP node according to the tunnel access information;

[0010] After the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE.

[0011] As a further aspect of the present specification, the connection request at least includes information of the mobile terminal and user information.

[0012] As a further aspect of the present specification, the connection information includes at least information of the mobile terminal and target CPE information.

[0013] As a further aspect of the present specification, the connection information also includes policy information and tunnel configuration information.

[0014] As another further aspect of the present specification, the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration, further comprising:

[0015] The SD-WAN controller determines the access PoP node and sends the connection information to the access PoP node.

[0016] As another further aspect of the present specification, the tunnel access information at least includes information of the mobile terminal, information of the access PoP node and tunnel information.

[0017] As another further aspect of the present specification, the tunnel access information also includes link monitoring configuration information, and the mobile terminal configures the mobile terminal according to the link detection configuration information so that the mobile terminal generates a link monitoring message for the SD-WAN tunnel between the mobile terminal and the target CPE.

[0018] As another further aspect of the present specification, after the access PoP node performs tunnel routing configuration, after establishing an SD-WAN tunnel connection between the mobile terminal and the target CPE, it also includes:

[0019] The SD-WAN controller receives link quality data generated by the link monitoring message sent by the mobile terminal;

[0020] The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data.

[0021] As another further aspect of the present specification, the SD-WAN controller receiving the link monitoring message of the SD-WAN tunnel between the mobile terminal and the target CPE from the mobile terminal further includes:

[0022] The mobile terminal sends a keep-alive message to the target CPE;

[0023] The target CPE feeds back a response message to the mobile terminal;

[0024] The mobile terminal generates link quality data of the SD-WAN tunnel between the mobile terminal and the target CPE according to the response message;

[0025] The link quality data is sent to the SD-WAN controller.

[0026] As another further aspect of the present specification, the SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further including:

[0027] When the SD-WAN controller obtains, based on the link quality data analysis, that the SD-WAN tunnel link quality between the mobile terminal and the access PoP node does not meet the link quality requirement, the mobile terminal is switched to a new access PoP node.

[0028] As another further aspect of this specification,

[0029] The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further comprising:

[0030] When the SD-WAN controller analyzes the link quality data and finds that the SD-WAN tunnel between the mobile terminal and the target CPE does not meet the link quality requirements as a whole, it generates connection information including new tunnel configuration information and switches the SD-WAN tunnel connection path between the mobile terminal and the target CPE.

[0031] As another further aspect of the present specification, the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration, further comprising:

[0032] The access PoP node creates a virtual machine corresponding to the connection request one by one according to the connection information;

[0033] The virtual machine is used to perform corresponding policy control on the message of the mobile terminal.

[0034] As another further aspect of the present specification, using the virtual machine to perform corresponding policy control on the message of the mobile terminal further includes:

[0035] The message enters the virtual machine through an uplink channel; wherein the uplink channel includes a first virtual network port and a second virtual network port; the message enters the first virtual network port of the corresponding virtual machine through the physical network port of the access PoP node; the second virtual network port of the virtual machine forwards the message to the TUN device, and the TUN device converts the message from kernel state to user state for acquisition by the process in the user state of the virtual machine;

[0036] The message processed by the policy information corresponding to the process of the user state of the virtual machine is output through a downlink channel; wherein the downlink channel includes a third virtual network port and a fourth virtual network port; the TUN device converts the processed user state message into a kernel state message, and the third virtual network port obtains the kernel state message; the fourth virtual network port sends the kernel state message to the physical network port of the access PoP node.

[0037] As another further aspect of this specification, the uplink channel further includes:

[0038] The message passing through the physical network port of the access PoP node enters the first virtual network port after being forwarded at layer 2 by the first bridge;

[0039] The downlink channel also includes:

[0040] The message passing through the fourth virtual network port is forwarded at layer 2 by the second bridge and then enters the physical network port of the access PoP node.

[0041] As another further aspect of the present specification, the uplink channel and the downlink channel belong to different network segments respectively.

[0042] As another further aspect of the present specification, the SD-WAN controller sends tunnel access information to the mobile terminal so that the mobile terminal can access the access PoP node according to the tunnel access information, further comprising:

[0043] The SD-WAN controller sends a primary access control list to the mobile terminal so that the mobile terminal only sends messages related to the target CPE to the access PoP node according to the primary access control list.

[0044] The embodiment of this specification also provides a SD-WAN network system, including:

[0045] SD-WAN controller, mobile terminal, access PoP node, target CPE;

[0046] The SD-WAN controller receives a connection request from the mobile terminal; the SD-WAN controller generates connection information according to the connection request, and sends the connection information to an access PoP node, and the access PoP node performs tunnel routing configuration according to the connection information; the SD-WAN controller sends tunnel access information to the mobile terminal, and the mobile terminal accesses the access PoP node according to the tunnel access information; after the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE.

[0047] The embodiments of the present specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0048] The embodiments of this specification also provide a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the above method is implemented.

[0049] The embodiments of this specification also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the above method is implemented.

[0050] By utilizing the embodiments of this specification, by incorporating the mobile terminal into the management of the SD-WAN controller, the mobile terminal executes the access function of the original access PoP node, and the access PoP node only performs policy control on the message, end-to-end control from the mobile terminal to the target CPE in the SD-WAN tunnel link can be achieved, making communication more stable and secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 The figure shows a flow chart of a method for a mobile terminal to access an SD-WAN according to an embodiment of this specification;

[0053] Figure 2 The system structure diagram of the mobile terminal accessing the SD-WAN network in the embodiment of this specification is shown;

[0054] Figure 3The figure is a flow chart of a mobile terminal sending a message according to an embodiment of the present specification;

[0055] Figure 4 The figure shows a schematic diagram of the structure of connecting to a PoP node to build a virtual machine in an embodiment of this specification;

[0056] Figure 5 The diagram shows a schematic diagram of a PoP node virtual machine receiving and sending a message according to an embodiment of the present specification;

[0057] Figure 6 The figure shows a flow chart of a link switching according to an embodiment of the present specification;

[0058] Figure 7 A computer device provided by an embodiment of this specification is shown.

[0059] [Description of Reference Numerals]

[0060] 702. Computer equipment;

[0061] 704, processor;

[0062] 706. Memory;

[0063] 708, driving mechanism;

[0064] 710, input / output module;

[0065] 712. Input devices;

[0066] 714. Output devices;

[0067] 716. Presentation equipment;

[0068] 718. Graphical user interface;

[0069] 720, network interface;

[0070] 722. Communication link;

[0071] 724. Communication bus. DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0073] The following is a brief description of some concepts involved in the embodiments of this specification, which does not limit these concepts:

[0074] SD-WAN: Software-defined WAN, where a central controller controls networking across WANs;

[0075] CPE: CPE is a hardware device and software application deployed at the user's location to connect the user's local network and the SD-WAN network;

[0076] PoP: It is a network node of the SD-WAN service provider, usually in a dedicated data center or network aggregation point, operated and maintained by the service provider;

[0077] Docker: Container refers to a virtualization method provided by the operating system. The operating system provides an independent operating environment for the container, so that the applications running in the environment can run in isolation from each other.

[0078] With the rise of mobile office, enterprise network requirements have changed significantly. It is impossible to ensure that mobile terminals are inside the CPE, which has a series of impacts on the evolution of SD-WAN networks. If a common VPN client is used on a mobile terminal to establish a tunnel connection to the access PoP node, and the message is forwarded to other CPE / PoP through the access PoP node; link quality monitoring, networking strategy, security strategy, etc. are performed on the access PoP node, the mobile terminal connected to the access PoP node is not managed by the SD-WAN controller, and the network security and transmission quality of the user communication process cannot be guaranteed; if the software that replaces the CPE / PoP is installed and executed on the mobile terminal, the SD-WAN networking and flow control security policies are sent to the mobile terminal. Due to the limitations of the mobile terminal operating system, the software of the mobile terminal cannot obtain the corresponding permissions and resources on these operating systems, resulting in these mobile terminals being unable to perform the functions of the CPE / PoP, and due to the limited data processing capabilities of the mobile terminal, or the influence of energy consumption, etc., the user experience of the mobile terminal will be reduced.

[0079] In an embodiment of this specification, a method for a mobile terminal to access an SD-WAN network is provided, such as Figure 1 The flowchart of a method for a mobile terminal to access an SD-WAN according to an embodiment of the specification is shown. In this figure, the functions of accessing a PoP node are split, and one part of the functions is placed in the mobile terminal, and the other part of the functions is placed in the access PoP node. The combination of the two can achieve the purpose of mobile terminal accessing the SD-WAN, solve the problem that the mobile terminal is not managed and controlled after accessing the SD-WAN, and improve the stability and security of the mobile terminal communicating through the SD-WAN, which specifically includes:

[0080] Step 101, the SD-WAN controller receives a connection request from a mobile terminal;

[0081] Step 102, the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration;

[0082] Step 103, the SD-WAN controller sends tunnel access information to the mobile terminal, so that the mobile terminal accesses the access PoP node according to the tunnel access information;

[0083] Step 104: After the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE.

[0084] Through the methods in the embodiments of this specification, the SD-WAN controller can control the connection of mobile terminals to access PoP nodes and subsequent SD-WAN tunnels, and can more comprehensively manage and control the reliability and flexibility of end-to-end links in the SD-WAN network.

[0085] In the embodiment of the present specification, the connection request at least includes information of the mobile terminal and user information.

[0086] In this embodiment, the information of the mobile terminal includes at least an IP address, and the user information includes at least information used for identity authentication, such as a user name and a password.

[0087] In the embodiment of this specification, the connection information at least includes information of the mobile terminal and target CPE information.

[0088] In this embodiment, the target CPE information includes at least the ID (unique identifier) ​​or IP address of the target CPE. The connection information may also include policy information, which includes, for example, security policy, service policy, link quality policy, networking policy, flow control policy, etc., for controlling the network service of the access PoP node and other corresponding PoP nodes after the current mobile terminal establishes an SD-WAN tunnel connection with the target CPE. The SD-WAN controller may also send the policy information to the PoP node included in the connection information, so that all relevant PoP nodes in the SD-WAN tunnel link formed according to the connection information can process and control the message transmitted between the mobile terminal and the target CPE according to the policy information.

[0089] The connection information may also include tunnel configuration information, which is generated by the SD-WAN controller. The access PoP node may use the tunnel configuration information to configure tunnel routing, that is, to configure the traffic path in the SD-WAN tunnel. If multiple PoP nodes are required to forward and relay messages between the mobile terminal and the target CPE, the access PoP node may configure each PoP node in the SD-WAN network according to the tunnel configuration information. The traffic in the embodiments of this specification refers to the traffic formed by a large number of messages.

[0090] In another embodiment, the tunnel configuration information can also be generated by the access PoP node based on the connection information. For example, a relatively stable, idle or nearest PoP node in the SD-WAN network is selected based on the information of the mobile terminal and the target CPE information, thereby forming an SD-WAN tunnel from the mobile terminal to the target CPE.

[0091] In an embodiment of the present specification, the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node to perform tunnel routing configuration, further including:

[0092] The SD-WAN controller determines the access PoP node and sends the connection information to the access PoP node.

[0093] In this embodiment, there may be multiple access PoP nodes, and the SD-WAN controller selects one access PoP node. For example, based on the distance between the mobile terminal and the PoP node, a PoP node closest to the mobile terminal may be selected as the access PoP node, or a PoP node may be selected as the access PoP node based on conditions such as the workload and distance of the PoP node. The selected access PoP node may establish an SD-WAN tunnel between the mobile terminal and the target CPE based on the information of the mobile terminal, so that the mobile terminal and the target CPE can achieve end-to-end stable and secure communication.

[0094] In the embodiment of the present specification, the tunnel access information at least includes information of the mobile terminal, information of the access PoP node, and tunnel information.

[0095] In this embodiment, the tunnel access information can be generated by the SD-WAN controller or by the access PoP node. The tunnel access information includes information for establishing a tunnel connection between the mobile terminal and the access PoP node, such as the IP address of the mobile terminal, the IP address of the access PoP node, the tunnel protocol used, etc.

[0096] The tunnel access information may also include link monitoring configuration information. The mobile terminal configures the mobile terminal according to the link detection configuration information, so that the mobile terminal can generate a link monitoring message for the SD-WAN tunnel between the mobile terminal and the target CPE. The link monitoring message also includes a response message fed back by the target CPE.

[0097] In the embodiment of the present specification, after the access PoP node performs tunnel routing configuration, after establishing an SD-WAN tunnel connection between the mobile terminal and the target CPE, it also includes:

[0098] The SD-WAN controller receives link quality data generated by the link monitoring message sent by the mobile terminal;

[0099] The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data.

[0100] In this embodiment, the link quality data can be used to reflect the link quality between the mobile terminal and the target CPE through the SD-WAN tunnel. The link quality data includes the number of transmitted messages, message delay time, jitter, etc.

[0101] The link quality data may also be used to reflect the link quality between any two PoP nodes, for example, including the number of messages transmitted between any two PoP nodes and the delay time and jitter of the messages.

[0102] The SD-WAN controller determines, based on the link quality data, that the link quality does not meet the link quality requirements, and then controls the SD-WAN tunnel to perform link switching.

[0103] The SD-WAN controller determines that the number of transmitted messages and / or the message delay time exceeds a preset threshold value. For example, when the number of transmitted messages and / or the message delay time between the access PoP node and other PoP nodes exceeds the preset threshold value, new tunnel configuration information is generated to control the relevant PoP nodes to perform SD-WAN tunnel link switching; or, when the number of transmitted messages and / or the message delay time between the mobile terminal and the access PoP node exceeds the preset threshold value, a new access PoP node is selected for switching.

[0104] In an embodiment of the present specification, the SD-WAN controller receiving the link quality data generated by the link monitoring message sent by the mobile terminal further includes:

[0105] The mobile terminal sends a keep-alive message to the target CPE;

[0106] The target CPE feeds back a response message to the mobile terminal;

[0107] The mobile terminal generates link quality data of the SD-WAN tunnel between the mobile terminal and the target CPE according to the response message;

[0108] The link quality data is sent to the SD-WAN controller.

[0109] In this step, the keep-alive message is a keep-alive message sent according to a predetermined time interval; the response message includes response information for the keep-alive message, and the time when the response message is sent, etc.; the link quality data contains information indicating the quality of the SD-WAN tunnel link, for example, the link quality data includes the number of keep-alive messages sent by the mobile terminal, the time when the keep-alive messages are sent, and the number of response messages received from the target CPE and the time when the response messages are sent, etc.; the SD-WAN controller can count the number of messages sent and received by the mobile terminal, the packet loss rate, the message delay time, the jitter, etc. according to the link quality data, so that the SD-WAN controller can judge the quality of the SD-WAN tunnel link between the mobile terminal and the target CPE according to the link quality data. When the quality of the SD-WAN tunnel link does not meet the link quality requirements (such as the operator's committed quality, SLA), the SD-WAN tunnel link can be switched to achieve end-to-end link quality control between the mobile terminal and the target CPE.

[0110] In an embodiment of the present specification, the SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further including:

[0111] When the SD-WAN controller obtains, based on the link quality data analysis, that the SD-WAN tunnel link quality between the mobile terminal and the access PoP node does not meet the link quality requirement, the mobile terminal is switched to a new access PoP node.

[0112] In this embodiment, when the SD-WAN controller analyzes the link quality data and obtains that the link quality of the mobile terminal does not meet the link quality requirements, and at the same time obtains that the link quality between the access PoP node and other PoP nodes or the target CPE meets the link quality requirements, an instruction can be sent to the mobile terminal to control it to disconnect the tunnel connection with the access PoP node, and reallocate a new access PoP node to control the mobile terminal to establish a tunnel connection with the new access PoP node, while the tunnel routing configuration between the new access PoP node and other PoP nodes or the target CPE does not need to be changed. Of course, the tunnel routing configuration between the new access PoP node and other PoP nodes or the target CPE can also be adaptively adjusted. For example, a new tunnel routing configuration can be made according to the workload of the PoP node, or network quality and other conditions.

[0113] In an embodiment of the present specification, the SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further including:

[0114] When the SD-WAN controller analyzes the link quality data and finds that the SD-WAN tunnel between the mobile terminal and the target CPE does not meet the link quality requirements as a whole, it generates connection information including new tunnel configuration information and switches the SD-WAN tunnel connection path between the mobile terminal and the target CPE.

[0115] In this embodiment, when the SD-WAN controller analyzes the link quality data and obtains that the SD-WAN tunnel between the mobile terminal and the target CPE does not meet the link quality requirements as a whole, the SD-WAN controller regenerates connection information including tunnel configuration information based on the status of all PoP nodes (or other related network devices) between the mobile terminal and the target CPE in the SD-WAN network, such as network status, load status, distance status, etc., and sends it to the reselected access PoP node, so that the access PoP node can perform tunnel routing configuration according to the new tunnel configuration information to form a new SD-WAN tunnel connection path.

[0116] In an embodiment of the present specification, the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node to perform tunnel routing configuration, further including:

[0117] The access PoP node creates a virtual machine corresponding to the connection request one by one according to the connection information;

[0118] The virtual machine is used to perform corresponding policy control on the message of the mobile terminal.

[0119] In this embodiment, a virtual machine corresponding to the connection information generated by each connection request can be created at the access PoP node, that is, each virtual machine is used to process a large number of messages (that is, traffic) in the SD-WAN tunnel between a mobile terminal and a target CPE (or multiple target CPEs), and the virtual machine uses the policy information for the SD-WAN tunnel to process the message traffic in the SD-WAN tunnel. By performing policy control on the messages in the SD-WAN tunnel established later by the virtual machine corresponding to the connection request one by one, the services from different mobile terminals or users can be more securely isolated, making the communication based on the SD-WAN network more secure.

[0120] In the embodiment of this specification, using the virtual machine to perform corresponding policy control on the message of the mobile terminal further includes:

[0121] The message enters the virtual machine through an uplink channel; wherein the uplink channel includes a first virtual network port and a second virtual network port; the message enters the first virtual network port of the corresponding virtual machine through the physical network port of the access PoP node; the second virtual network port of the virtual machine forwards the message to the TUN device, and the TUN device converts the message from kernel state to user state for acquisition by the process in the user state of the virtual machine;

[0122] The message processed by the policy information corresponding to the process of the user state of the virtual machine is output through a downlink channel; wherein the downlink channel includes a third virtual network port and a fourth virtual network port; the TUN device converts the processed user state message into a kernel state message, and the third virtual network port obtains the kernel state message; the fourth virtual network port sends the kernel state message to the physical network port of the access PoP node.

[0123] In this embodiment, the first virtual network port and the second virtual network port, the third virtual network port and the fourth virtual network port are matched by corresponding routing strategies. The routing strategy may include, for example, the correspondence between virtual network ports and virtual network ports, and the correspondence between virtual network ports and physical network ports.

[0124] The virtual machine user state process can also parse the message to analyze which messages should be forwarded to the target CPE and which messages should be forwarded to the Internet. That is, all messages that do not need to be forwarded to the target CPE are forwarded to the Internet without occupying the transmission resources of the SD-WAN tunnel.

[0125] In the embodiment of this specification, the uplink channel also includes:

[0126] The message passing through the physical network port of the access PoP node enters the first virtual network port after being forwarded at layer 2 by the first bridge;

[0127] The downlink channel also includes:

[0128] The message passing through the fourth virtual network port is forwarded at layer 2 by the second bridge and then enters the physical network port of the access PoP node.

[0129] In the embodiment of this specification, the uplink channel and the downlink channel belong to different network segments respectively.

[0130] By isolating the connection requests initiated by different mobile terminals through different virtual machines, the security of the SD-WAN network can be further improved.

[0131] In an embodiment of the present specification, the SD-WAN controller sends tunnel access information to the mobile terminal so that the mobile terminal can access the access PoP node according to the tunnel access information, further comprising:

[0132] The SD-WAN controller sends a primary access control list to the mobile terminal so that the mobile terminal only sends messages related to the target CPE to the access PoP node according to the primary access control list.

[0133] In this embodiment, the primary access control list (ACL) may only include five-tuple information, namely, source IP address, source port number, destination IP address, destination port number, and protocol information. The mobile terminal may determine whether the destination of the message is on the target CPE side according to the primary access control list. If the destination of the message to be sent is not on the target CPE side, the message is not sent to the access PoP node to enter the SD-WAN tunnel, thereby reducing the occupation of tunnel resources. Due to the limited processing capacity of the mobile terminal and the fact that the operating system of some mobile terminals limits the resource occupation of the application, comprehensive access control cannot be performed on the mobile terminal. Only limited access control can be performed, and the message is not parsed. Whether to send to the access PoP node is determined only according to the destination of the message (or message type, etc.). Other simple access processing tasks may also be processed on the mobile terminal, such as the generation and reporting of link quality data, the initiation of connection requests, and the tunnel connection with the access PoP node assigned by the SD-WAN controller. Complex policy control is not performed on the mobile terminal. The policy control is processed at the access PoP node and other related PoP nodes.

[0134] like Figure 2The system structure diagram of the mobile terminal accessing the SD-WAN network in the embodiment of this specification is shown. In this figure, it is described that the mobile terminal performs SD-WAN network access processing under the control of the SD-WAN controller, the access PoP node performs policy control, and jointly establishes the process of SD-WAN tunnel. In this embodiment, the mobile terminal can be, for example, a mobile phone, a tablet computer, a laptop computer or other electronic device. A specific software program is installed on the mobile terminal to complete the SD-WAN network access processing. In the embodiment of this specification, the mobile terminal with such a specific software program is referred to as a mobile terminal. The access PoP node can be any PoP node in the SD-WAN network, such as a computer device or server with strong data processing capabilities, wherein the application server can be a computer device or server that provides business services. There can be multiple CPEs in the SD-WAN network. This figure only shows one CPE as the target CPE, but it is not limited to this. The target CPE side is connected to an internal network, and there is at least one computer device or electronic device in the internal network to communicate with the mobile terminal. The purpose of the mobile terminal accessing the SD-WAN network is achieved based on the system:

[0135] Step 201: The mobile terminal initiates a connection request to the SD-WAN controller.

[0136] In this step, the mobile terminal may send user authentication information to the SD-WAN controller via the Internet, which may include user name, password, verification code and other verification information.

[0137] The connection request may include information about the mobile terminal, user information, and other information. The mobile terminal information may include, for example, the IP address and / or MAC address of the mobile terminal, etc., which are used to communicate with the mobile terminal. The mobile terminal information may also include information such as the mobile terminal type (mobile phone, tablet computer, etc.), performance parameters (memory, storage space, etc.), system type, etc.; user information may include, for example, user name, password, and other information. The connection request may also include positioning information of the mobile terminal, such as coordinate information, which is used to determine the location of the mobile terminal. The connection request may also include other information, which is not limited here.

[0138] Step 202: After the SD-WAN controller passes the verification, it generates connection information.

[0139] In this step, the SD-WAN controller verifies the connection request initiated by the mobile terminal and verifies the user authentication information. After the verification is passed, the SD-WAN controller can generate connection information according to the connection request. In this embodiment, the connection information may include mobile terminal information and target CPE information for determining which CPE the mobile terminal is connected to, wherein the target CPE can be determined by user information, that is, according to the user name, it can be determined which CPE node or nodes the user is associated with, and which CPE node the connection request should be connected to, and the CPE node is the target CPE node; tunnel configuration information generated by the SD-WAN controller (in other embodiments, it can also be generated by the access PoP node), the tunnel configuration information includes the mobile terminal to the target The information of all PoP nodes between CPEs, and may also include the configuration information of the virtual machines accessed inside the PoP nodes; the connection information may also include the policy information of each PoP node in the SD-WAN tunnel between the mobile terminal and the target CPE, that is, the SD-WAN controller determines the networking strategy (message destination path) of the PoP node for the traffic between the mobile terminal and the target CPE, the complete security strategy (DPI, virus protection, attack prevention, etc.), the flow control strategy (traffic shaping, speed limit, priority guarantee, etc.), the optimization strategy (protocol acceleration, compression, caching and other SD-WAN conventional functions), etc., and processes and forwards the traffic according to the matching results; the connection information may also include the tunnel configuration information between the mobile terminal and the access PoP node, for example, it may be the IPSec tunnel configuration information.

[0140] The SD-WAN controller may select an access PoP node adapted to the connection request according to the connection request. For example, a PoP node closest to the mobile terminal may be selected as the access PoP node according to the positioning information of the mobile terminal, or a PoP node matching the system type of the mobile terminal may be selected as the access PoP node. Alternatively, a PoP node adapted to the network speed of the mobile terminal may be selected as the access PoP node (for example, a PoP node with a network speed equivalent to that of a mobile terminal with a slower network speed may be adapted as the access PoP node). Alternatively, a PoP node specified by the user in the connection request may be used as the access PoP node.

[0141] In step 203, the SD-WAN controller sends the connection information to the access PoP node for tunnel routing configuration.

[0142] In this step, after the access PoP node receives the connection information sent by the SD-WAN controller, it establishes an SD-WAN tunnel between the mobile terminal and the target CPE.

[0143] The access PoP node establishes a one-to-one corresponding virtual machine for the connection request initiated by the mobile terminal, and uses the virtual machine to communicate with the mobile terminal, so that corresponding virtual machines can be established for different connection requests to provide the service of the access PoP node, thereby realizing isolation of communication between mobile terminals and making communication more secure.

[0144] The access PoP node can also use the tunnel configuration information in the connection information to configure related PoP nodes or other resources to form an SD-WAN tunnel between the mobile terminal and the target CPE. The access PoP node configures the policy control to the virtual machine corresponding to the mobile terminal and the target CPE according to the tunnel configuration information, so that the virtual machine is specifically responsible for the policy control of the mobile terminal and the target CPE, that is, one virtual machine handles the message forwarding from one mobile terminal to one or more target CPEs. The access PoP node can be directly connected to the target CPE through the SD-WAN tunnel.

[0145] When the access PoP node tunnel routing configuration is completed, feedback is given to the SD-WAN controller.

[0146] Step 204, the SD-WAN controller sends tunnel access information to the mobile terminal.

[0147] In this step, the tunnel access information sent by the SD-WAN controller to the mobile terminal includes connection information of the access PoP node, such as information including the IP address and port number of the access PoP node, and information of the mobile terminal, such as information including the IP address and port number of the mobile terminal; the tunnel access information may also include tunnel protocol information used by the mobile terminal and the access PoP node, such as general tunnel protocols such as IPSec, L2TP, GRE, VxLan, etc., or other private tunnel protocols may be used without limitation.

[0148] In this embodiment, the tunnel access information may also include a primary access control list (ACL). Due to the limited hardware processing capability of the mobile terminal, or due to the limitations of the operating system of the mobile terminal, such as the memory usage restrictions on applications and the restrictions on application permissions in some operating systems, the mobile terminal may not be able to handle complex policy controls. Therefore, only relatively simple access processing tasks are handed over to the mobile terminal for processing, such as not performing deep packet parsing (DPI) on the messages to be sent on the mobile terminal. The primary access control list can be used to preliminarily screen whether the resources to be accessed by the mobile terminal need to be sent to the target CPE for processing through the SD-WAN network, for example, by judging the IP address of the target to be accessed, or by the message type, or the five-tuple information of the message, to judge whether the message needs to be sent to the access PoP node to enter the SD-WAN network. The primary access list has the characteristics of the message that needs to be transmitted to the target CPE through the SD-WAN network, such as the IP address of the target CPE, or the IP address of the target terminal on the target CPE side, or the type of message and other information. If the message that the mobile terminal needs to send is consistent with the characteristics in the primary access list, the message is sent to the access PoP node through the tunnel between the mobile terminal and the access PoP node. If the message that the mobile terminal needs to send does not match the characteristics in the primary access list, the message is sent to the target object through the Internet, thereby saving data processing resources and bandwidth resources of the access PoP node.

[0149] The tunnel access information may also include link monitoring configuration information. The mobile terminal is configured according to the link monitoring configuration information, and after establishing the SD-WAN tunnel between the mobile terminal and the target CPE, the mobile terminal periodically sends a keep-alive message to the target CPE, and the target CPE feeds back a response message to the mobile terminal; the mobile terminal generates link quality data of the SD-WAN tunnel from the mobile terminal to the target CPE based on the response message, and sends the link quality data to the SD-WAN controller.

[0150] Step 205: The mobile terminal creates a tunnel to access the PoP node according to the tunnel access information.

[0151] like Figure 3The flowchart of the mobile terminal sending a message in the embodiment of the present specification is shown. In this figure, the process of the mobile terminal intercepting the message to be sent to the access PoP node and sending it to the access PoP node is described. In this embodiment, there are fewer records in the primary access control list, and only some relatively important forwarding features are recorded. The messages with these forwarding features are screened out and sent to the access PoP node, and the unscreened messages are sent to the destination through the ordinary Internet. Or, on the contrary, the screened messages are sent to the destination through the ordinary Internet, and the unscreened messages are sent to the access PoP node through the tunnel. This can further reduce the message processing of the mobile terminal, save the hardware and software resources of the mobile terminal, and will not cause the problems of high power consumption and slow response of the mobile terminal. Specifically, it includes:

[0152] Step 301: intercept and send a message through a hook node provided by the operating system.

[0153] Step 302: Screen the intercepted message through the primary access control list.

[0154] In this step, the hook node provided by the mobile terminal operating system is used to intercept the message to be sent, and the five-tuple information of the message is compared with the record in the primary access control list, so as to determine whether the message to be sent should be sent to the access PoP node.

[0155] Step 303: Encapsulate the selected messages to be sent to the access PoP node using a tunnel protocol.

[0156] In this step, the mobile terminal encapsulates the screened messages using the tunnel protocol in the received tunnel access information, and may also encapsulate the screened messages using a preset tunnel protocol.

[0157] Step 304: Send the encapsulated message to the tunnel connected to the PoP node.

[0158] Step 305: Send the message that should not be sent to the access PoP node through the Internet.

[0159] like Figure 4 The figure shows a schematic diagram of the structure of connecting to a PoP node to build a virtual machine in an embodiment of this specification. Figure 5The figure shows a schematic diagram of receiving and sending messages by a virtual machine of an access PoP node in an embodiment of the present specification. The two figures describe that the virtual machine configured by the access PoP node according to the connection information corresponds to a tunnel for each mobile terminal, and isolates the connection between the mobile terminal and the access PoP node, thereby improving the security of the access PoP node. The virtual machine can be implemented by technologies such as kvm, docker, and esxi. The traffic in this embodiment is a general term for messages sent or received by a mobile terminal or a target CPE. This embodiment only describes the processing process of the access PoP node sending messages to the mobile terminal. The message processing process for the target CPE feedback corresponds to this embodiment and will not be repeated. The method of this embodiment specifically includes:

[0160] Step 501: The access PoP node receives a message sent by a mobile terminal.

[0161] In this step, the access PoP node receives the message sent by the mobile terminal through a physical network port, and the IP address of the physical network port may be, for example, 192.168.1.69.

[0162] Step 502: forward the message to bridge 1.

[0163] In this step, the message is routed to virtual port 1 of bridge 1 by accessing the routing policy preset by the PoP node itself or the routing policy generated by the SD-WAN controller. The IP address of virtual port 1 is 172.17.0.1, and the message is forwarded at layer 2 on bridge 1.

[0164] Step 503: Bridge 1 forwards the message to the virtual machine.

[0165] In this step, bridge 1 forwards the message from virtual network port 1 to virtual network port 2 for layer 2 forwarding. Through virtual network port 2, the message can be directly forwarded to virtual network port 3 of the virtual machine, where the IP address of virtual network port 3 is 172.17.0.2. It can be seen that virtual network ports 1, 2, 3, and 4 belong to the uplink channel of the message.

[0166] Step 504: convert the message from kernel state to user state.

[0167] In this step, the kernel-state message is routed from the virtual network port 3 of the virtual machine to the virtual network port 4 by accessing the routing policy preset by the PoP node itself or the routing policy generated by the SD-WAN controller, and the kernel-state message is converted into a user-state message through the TUN device (transparent network device) in the virtual machine for reading and processing by the user-state process.

[0168] Step 505: The message processing module of the virtual machine processes the message according to the policy information.

[0169] In this step, the message processing module in the user state of the virtual machine reads the message from the TUN device, and processes the received message using the policy information preset by the access PoP node itself or the policy information generated by the SD-WAN controller. The message processing module processes the message, which may include processing the traffic formed by a large number of messages according to the five-tuple information of the message, and may also include deep parsing of the message and analyzing the data content carried in the message, which is not limited here.

[0170] Step 506: convert the message from user mode to kernel mode.

[0171] In this step, the message processing module of the virtual machine converts the processed user-state message into a kernel-state message through the TUN device, and then sends the kernel-state message to the virtual network port 5 through the routing policy preset by the access PoP node itself or the routing policy generated by the SD-WAN controller. The virtual network port 5 forwards the kernel-state message to the virtual network port 6, where the IP address of the virtual network port 6 is 172.18.0.2.

[0172] Step 507: The virtual machine forwards the message to bridge 2.

[0173] In this step, the virtual network port 6 of the virtual machine directly forwards the processed message to the virtual network port 7 of the bridge 2, and the virtual network port 7 forwards the message layer 2 to the virtual network port 8 of the bridge 2, wherein the IP address of the virtual network port 8 is 182.18.0.1. Thus, it can be seen that the downlink channel of the message includes virtual network ports 5, 6, 7, and 8, and the network segments of the uplink channel and the downlink channel belong to different network segments, thereby performing layer 3 message forwarding.

[0174] Step 508: Bridge 2 forwards the message to the physical network port connected to the PoP node.

[0175] In this step, the message of bridge 2 is routed to the physical network port of the access PoP node through the routing policy preset by the access PoP node itself or the routing policy generated by the SD-WAN controller.

[0176] Step 509: The access PoP node sends the message.

[0177] In this step, based on the analysis and processing results of the message processing module, the message that should be sent to the target CPE can be forwarded to the target CPE through the tunnel of the SD-WAN network via other PoP nodes, or directly sent to the target CPE; the message that does not need to be carried by the tunnel of the SD-WAN network (for example, the message sent to other destinations) will be sent to the corresponding target through the ordinary Internet.

[0178] like Figure 6The flowchart of a link switching of an embodiment of the present specification is shown. In this figure, it is described that after the mobile terminal generates a keep-alive message for link monitoring according to the link monitoring configuration information sent by the SD-WAN controller, the keep-alive message is sent to the target CPE, and a response message from the target CPE is received (wherein both the keep-alive message and the response message can be referred to as a link monitoring message), and the link quality data generated according to the link monitoring message is sent to the SD-WAN controller, so that the SD-WAN controller controls the switching of the SD-WAN tunnel between the mobile terminal and the target CPE according to the link quality data, specifically including:

[0179] Step 601: The mobile terminal periodically sends a keep-alive message to a target CPE.

[0180] In this step, the timing time interval can be set according to the link monitoring configuration information. The keep-alive message can be a message with no practical meaning, or a message with a specific identification bit to indicate that the purpose of the message is to monitor the SD-WAN tunnel between the mobile terminal and the target CPE.

[0181] Step 602: After receiving the keep-alive message, the target CPE feeds back a response message.

[0182] In this step, the response message corresponds to the keep-alive message.

[0183] Step 603: The mobile terminal generates link quality data according to the response message.

[0184] In this step, the link quality data may include information such as the number of keep-alive messages sent by the mobile terminal, the time of sending the keep-alive messages, and the number of response messages received from the target CPE and the time of sending the response messages.

[0185] Step 604: The mobile terminal sends the link quality data to the SD-WAN controller.

[0186] In this step, the mobile terminal may send the link quality data to the SD-WAN controller through a tunnel, or may send the link quality data to the SD-WAN controller through the Internet.

[0187] In other embodiments, the mobile terminal may also calculate whether the current link meets the link quality requirements based on the link quality data, and if not, send the link quality data to the SD-WAN controller.

[0188] Step 605: The SD-WAN controller switches the link according to the link quality data.

[0189] In this step, the SD-WAN controller analyzes the link quality data and determines that the SD-WAN tunnel link quality between the mobile terminal and the access PoP node does not meet the link quality requirements, then selects a new PoP node as the access PoP node to establish a tunnel connection with the mobile terminal.

[0190] As an application scenario in this embodiment, when the mobile terminal is in a high-speed moving vehicle, after the mobile terminal establishes an SD-WAN tunnel connection with the target CPE through a first access PoP node, when the vehicle moves to a position far away from the first access PoP node, the link quality of the SD-WAN tunnel between the mobile terminal and the first access PoP node cannot meet the requirements. The SD-WAN controller will select a suitable PoP node as the second access PoP node based on the position of the mobile terminal (or may also consider the direction of movement, speed, etc.). For example, the PoP node closest to the mobile terminal may be selected as the second access PoP node, or a PoP node that matches the moving direction, speed, and distance of the mobile terminal may be selected as the second access PoP node.

[0191] In this embodiment, when it is necessary to switch the access PoP node, the SD-WAN controller sends new connection information (for example, including tunnel configuration information and policy information) to the second access PoP node, so that the second access PoP node can perform tunnel routing configuration, policy processing, and establish a virtual machine; the SD-WAN controller controls the mobile terminal to disconnect from the first access PoP node, and immediately controls the mobile terminal to establish a tunnel connection with the second access PoP node; the SD-WAN controller controls the first access PoP node to destroy the tunnel with the mobile terminal, delete the corresponding connection information, and enable the first access PoP node to recycle virtual machine resources.

[0192] In other embodiments, the SD-WAN tunnel between the mobile terminal and the target CPE may pass through multiple PoP nodes or other devices (such as application servers, etc.), and each node or device will feed back its own network status to the SD-WAN controller in a timed manner or in a request-response manner. The SD-WAN controller can obtain the network status of all nodes or devices in the SD-WAN tunnel between the mobile terminal and the target CPE, thereby evaluating the link quality of the SD-WAN tunnel between the mobile terminal and the target CPE. When the link quality of a certain section of the SD-WAN tunnel link does not meet the requirements, the corresponding node is switched or the switch adjustment link is switched.

[0193] After switching the link, the mobile terminal continues to feed back the link quality of the SD-WAN tunnel between the mobile terminal and the target CPE to the SD-WAN controller through link quality data. If the link quality after switching the link still cannot meet the link quality requirements, the SD-WAN controller needs to switch the link again until the quality of the entire link obtained by analyzing the link quality data reported by the mobile terminal meets the link quality requirements. The link quality of the entire link can be reflected through end-to-end link monitoring messages and the generated link quality data, avoiding the problem of inaccurate calculation of the entire link quality based on the combined monitoring results of the segmented links. It can truly reflect the link quality of the entire SD-WAN tunnel link from the mobile terminal to the target CPE, thereby improving the link quality of the entire link, ensuring the stability of the entire link, and improving the user experience.

[0194] In other embodiments, when the mobile terminal actively disconnects the tunnel connection with the access PoP node (for example, after the mobile terminal completes the communication with the target CPE), or passively disconnects the tunnel connection with the access PoP node (for example, network anomalies, failures, etc.), the SD-WAN controller will monitor the situation and notify the access PoP node of the mobile terminal offline message. The access PoP node destroys the tunnel, deletes the connection information (routing configuration information and policy information, etc.), stops the virtual machine, and thus reclaims system resources.

[0195] like Figure 7 A computer device provided in an embodiment of this specification is shown. The method for a mobile terminal to access an SD-WAN network in an embodiment of this specification can be run on a computer device in this embodiment to execute the above method of this specification. The computer device 702 may include one or more processors 704, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. The computer device 702 may also include any memory 706 for storing any kind of information such as code, settings, data, etc. Non-limitingly, for example, the memory 706 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory may use any technology to store information. Further, any memory may provide volatile or non-volatile retention of information. Further, any memory may represent a fixed or removable component of the computer device 702. In one case, when the processor 704 executes an associated instruction stored in any memory or a combination of memories, the computer device 702 may perform any operation of the associated instruction. The computer device 702 also includes one or more drive mechanisms 708 for interacting with any storage, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0196] The computer device 702 may also include an input / output module 710 (I / O) for receiving various inputs (via input devices 712) and for providing various outputs (via output devices 714). A specific output mechanism may include a presentation device 716 and an associated graphical user interface (GUI) 718. In other embodiments, the input / output module 710 (I / O), the input device 712, and the output device 714 may not be included, and the computer device 702 may be used as a computer device in a network. The computer device 702 may also include one or more network interfaces 720 for exchanging data with other devices via one or more communication links 722. One or more communication buses 724 couple the components described above together.

[0197] The communication link 722 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 722 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0198] The embodiment of the present specification also provides a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to execute the method as described above.

[0199] It should be understood that in the various embodiments of this specification, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0200] It should also be understood that in the embodiments of this specification, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this specification generally indicates that the associated objects before and after are in an "or" relationship.

[0201] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this specification.

[0202] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0203] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0204] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this specification.

[0205] In addition, each functional unit in each embodiment of this specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0206] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0207] Specific embodiments are used in this specification to illustrate the principles and implementation methods of this specification. The description of the above embodiments is only used to help understand the methods and core ideas of this specification. At the same time, for those skilled in the art, according to the ideas of this specification, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on this specification.

Claims

1. A method for a mobile terminal to access an SD-WAN network, characterized in that include, The SD-WAN controller receives the connection request from the mobile terminal; The SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration; The SD-WAN controller sends tunnel access information to the mobile terminal, so that the mobile terminal accesses the access PoP node according to the tunnel access information; After the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE; Among them, the tunnel access information also includes link monitoring configuration information, and the mobile terminal configures the mobile terminal according to the link detection configuration information, so that the mobile terminal generates a link monitoring message for the SD-WAN tunnel between the mobile terminal and the target CPE.

2. The method according to claim 1, characterized in that The connection request includes at least information of the mobile terminal and user information.

3. The method according to claim 1, characterized in that The connection information includes at least information of the mobile terminal and target CPE information.

4. The method according to claim 3, characterized in that The connection information also includes policy information and tunnel configuration information.

5. The method according to claim 1, characterized in that The SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration, further comprising: The SD-WAN controller determines the access PoP node and sends the connection information to the access PoP node.

6. The method according to claim 1, characterized in that The tunnel access information includes at least information about the mobile terminal, information about the access PoP node, and tunnel information.

7. The method according to claim 6, characterized in that After the access PoP node performs tunnel routing configuration, after establishing an SD-WAN tunnel connection between the mobile terminal and the target CPE, the method further includes: The SD-WAN controller receives link quality data generated by the link monitoring message sent by the mobile terminal; The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data.

8. The method according to claim 7, characterized in that The SD-WAN controller receiving the link quality data generated by the link monitoring message sent by the mobile terminal further includes: The mobile terminal sends a keep-alive message to the target CPE; The target CPE feeds back a response message to the mobile terminal; The mobile terminal generates link quality data of the SD-WAN tunnel between the mobile terminal and the target CPE according to the response message; The link quality data is sent to the SD-WAN controller.

9. The method according to claim 7, characterized in that: The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further comprising: When the SD-WAN controller obtains, based on the link quality data analysis, that the SD-WAN tunnel link quality between the mobile terminal and the access PoP node does not meet the link quality requirement, the mobile terminal is switched to a new access PoP node.

10. The method according to claim 7, characterized in that The SD-WAN controller switches the SD-WAN tunnel connection path according to the link quality data further comprising: When the SD-WAN controller analyzes the link quality data and finds that the SD-WAN tunnel between the mobile terminal and the target CPE does not meet the link quality requirements as a whole, it generates connection information including new tunnel configuration information and switches the SD-WAN tunnel connection path between the mobile terminal and the target CPE.

11. The method according to claim 1, characterized in that: The SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node for tunnel routing configuration, further comprising: The access PoP node creates a virtual machine corresponding to the connection request one by one according to the connection information; The virtual machine is used to perform corresponding policy control on the message of the mobile terminal.

12. The method according to claim 11, characterized in that Using the virtual machine to perform corresponding policy control on the message of the mobile terminal further includes: The message enters the virtual machine through an uplink channel; wherein the uplink channel includes a first virtual network port and a second virtual network port; the message enters the first virtual network port of the corresponding virtual machine through the physical network port of the access PoP node; the second virtual network port of the virtual machine forwards the message to the TUN device, and the TUN device converts the message from kernel state to user state for acquisition by the process in the user state of the virtual machine; The message processed by the policy information corresponding to the process of the user state of the virtual machine is output through a downlink channel; wherein the downlink channel includes a third virtual network port and a fourth virtual network port; the TUN device converts the processed user state message into a kernel state message, and the third virtual network port obtains the kernel state message; the fourth virtual network port sends the kernel state message to the physical network port of the access PoP node.

13. The method according to claim 12, characterized in that The uplink channel also includes: The message passing through the physical network port of the access PoP node enters the first virtual network port after being forwarded at layer 2 by the first bridge; The downlink channel also includes: The message passing through the fourth virtual network port is forwarded at layer 2 by the second bridge and then enters the physical network port of the access PoP node.

14. The method according to claim 13, characterized in that The uplink channel and the downlink channel belong to different network segments respectively.

15. The method according to claim 1, characterized in that The SD-WAN controller sends tunnel access information to the mobile terminal so that the mobile terminal can access the access PoP node according to the tunnel access information, further comprising: The SD-WAN controller sends a primary access control list to the mobile terminal so that the mobile terminal only sends messages related to the target CPE to the access PoP node according to the primary access control list.

16. An SD-WAN network system, characterized in that include, SD-WAN controller, mobile terminal, access PoP node, target CPE; The SD-WAN controller receives a connection request from the mobile terminal; the SD-WAN controller generates connection information according to the connection request, and sends the connection information to the access PoP node, and the access PoP node performs tunnel routing configuration according to the connection information; the SD-WAN controller sends tunnel access information to the mobile terminal, and the mobile terminal accesses the access PoP node according to the tunnel access information; after the access PoP node performs tunnel routing configuration, an SD-WAN tunnel connection is established between the mobile terminal and the target CPE; wherein the tunnel access information also includes link monitoring configuration information, and the mobile terminal configures the mobile terminal according to the link detection configuration information, so that the mobile terminal generates a link monitoring message for the SD-WAN tunnel between the mobile terminal and the target CPE.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 15 is implemented.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 15 is executed.

19. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 15 is implemented.

Images