Layer 2 protocol transparent transmission method, device, equipment and storage medium based on access control list

Abstract

The present application discloses a method, device, equipment and storage medium for layer 2 protocol transparent transmission based on access control lists, and relates to the technical field of protocol transparent transmission. The method includes: filtering out network messages that meet preset conditions based on access control list rules; if the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, adjusting the destination media access control address of the network message to a user-configured multicast media access control address, and adding a mapping field to the user-configured multicast media access control address; forwarding the network message with the adjusted mapping field to the next-level network. The present application filters the specific destination media access control address of the message through access control list rules, thereby realizing the transparent transmission of the layer 2 protocol, quickly eliminating irrelevant messages, reducing the burden of processing and analysis, thereby reducing configuration errors and management complexity, and improving the overall data processing speed.

Description

Technical Field

[0001] The present application relates to the technical field of protocol transparent transmission, and in particular to a layer 2 protocol transparent transmission method, device, equipment and storage medium based on an access control list. Background Art

[0002] In today's highly digital era, the efficiency, stability and flexibility of network communications are crucial. With the continuous expansion of enterprise scale and the increasing complexity of network applications, higher requirements are placed on network transmission technology. Traditional network transmission methods often face many challenges when facing large-scale data transmission and multi-service integration. Currently, Layer 2 protocol transparent transmission based on virtual local area network (VLAN) and VLAN stacking (double-layer VLAN, VLAN Stacking, QinQ) is a common technology in the network, but it still has the disadvantage of complicating network management and requiring additional network planning and maintenance. Summary of the invention

[0003] The main purpose of the present application is to provide a method, device, equipment and storage medium for layer 2 protocol transparent transmission based on access control lists, aiming to solve the technical problem of low network management efficiency of existing layer 2 protocol transparent transmission methods.

[0004] To achieve the above purpose, the present application proposes a layer 2 protocol transparent transmission method based on an access control list, and the layer 2 protocol transparent transmission method based on an access control list includes:

[0005] Filter out network messages that meet preset conditions based on access control list rules;

[0006] If the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, adjusting the destination media access control address of the network message to a multicast media access control address configured by the user, and adding a mapping field to the multicast media access control address configured by the user;

[0007] The network message with the adjusted mapping field is forwarded to the next level network.

[0008] In one embodiment, after the step of filtering out network messages that meet preset conditions based on the access control list rules, the method further includes:

[0009] If the destination media access control address of the network message is a multicast media access control address configured by the user, obtaining the corresponding media access control address of the layer 2 protocol message according to the mapping field of the network message;

[0010] The destination media access control address of the network message is restored to the destination media access control address of the corresponding layer 2 protocol message, and the mapping field of the network message is deleted.

[0011] In one embodiment, before the step of obtaining the media access control address of the corresponding layer 2 protocol message according to the mapping field of the network message, the step further includes:

[0012] Defining the field type, field length and field value in the network message;

[0013] According to the defined network message, a corresponding relationship between the network message and the media access control address of the layer 2 protocol message is established;

[0014] The step of obtaining the media access control address of the corresponding layer 2 protocol message according to the mapping field of the network message comprises:

[0015] The media access control address of the layer 2 protocol message corresponding to the mapping field of the network message is determined according to the corresponding relationship.

[0016] In one embodiment, the step of filtering out network messages that meet preset conditions based on the access control list rules includes:

[0017] Determining access control list rules regarding a destination media access control address of a network message;

[0018] Extracting a destination media access control address from a message frame of the network message;

[0019] Comparing the extracted destination media access control address with the rules in the access control list one by one;

[0020] If a matching rule is found, it is determined that the network message meets the preset condition;

[0021] Filter out network messages that meet the preset conditions.

[0022] In one embodiment, before the step of adjusting the destination media access control address of the network message to a multicast media access control address configured by the user, the step further includes:

[0023] If the multicast media access control address configured by the user matches the multicast media access control address of the target protocol, prompting the user to reconfigure the multicast media access control address;

[0024] If the multicast media access control address configured by the user does not match the multicast media access control address of the target protocol, the step of adjusting the destination media access control address of the network message to the multicast media access control address configured by the user is performed.

[0025] In one embodiment, before the step of adding a mapping field to the multicast media access control address configured by the user, the method further includes:

[0026] Determine whether the Layer 2 protocol message transparent transmission function is enabled;

[0027] When the layer 2 protocol message transparent transmission function is enabled, the mapping field of the multicast media access control address configured by the user is added or deleted.

[0028] In one embodiment, the step of forwarding the network message with the adjusted mapping field to the next level network includes:

[0029] Detecting the integrity of the network message with the mapping field adjusted, and detecting the validity of the destination media access control address of the network message with the mapping field adjusted;

[0030] If the network message with the mapping field adjusted is complete and the destination media access control address of the network message with the mapping field adjusted is valid, the network message with the mapping field adjusted is allowed to be forwarded to the next level network.

[0031] In addition, to achieve the above purpose, the present application also proposes a layer 2 protocol transparent transmission device based on an access control list, and the layer 2 protocol transparent transmission device based on an access control list includes:

[0032] A screening module is used to screen out network messages that meet preset conditions based on access control list rules;

[0033] A judgment module, configured to adjust the destination media access control address of the network message to a multicast media access control address configured by the user if the type of the destination media access control address of the network message is a media access control address of a layer 2 protocol message, and add a mapping field to the multicast media access control address configured by the user;

[0034] The forwarding module is used to forward the network message with the adjusted mapping field to the next level network.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a Layer 2 protocol transparent transmission device based on an access control list, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the Layer 2 protocol transparent transmission method based on an access control list as described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the Layer 2 protocol transparent transmission method based on the access control list as described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the layer 2 protocol transparent transmission method based on the access control list as described above are implemented.

[0038] One or more technical solutions proposed in this application have at least the following technical effects: network messages that meet preset conditions are screened out based on access control list rules; if the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, the destination media access control address of the network message is adjusted to the multicast media access control address configured by the user, and a mapping field is added to the multicast media access control address configured by the user; the network message with the adjusted mapping field is forwarded to the next level network. Compared with the prior art, this application screens the target network message through the access control list function, and quickly excludes irrelevant messages based on the media access control address of the message, reducing the processing and analysis burden, thereby reducing configuration errors and management complexity, and improving the overall data processing speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0041] Figure 1 A flow chart of the first embodiment of the layer 2 protocol transparent transmission method based on the access control list of the present application;

[0042] Figure 2 A flowchart of determining whether a multicast media access control address configured by a user is valid is provided for the first embodiment of the layer 2 protocol transparent transmission method based on an access control list of the present application;

[0043] Figure 3 A flow chart of the second embodiment of the layer 2 protocol transparent transmission method based on the access control list of the present application is provided;

[0044] Figure 4 A flow chart of the third embodiment of the layer 2 protocol transparent transmission method based on the access control list of the present application is provided;

[0045] Figure 5 A brief flow chart of the first embodiment of the layer 2 protocol transparent transmission method based on the access control list of the present application is provided;

[0046] Figure 6 A schematic diagram of the module structure of a layer 2 protocol transparent transmission device based on an access control list according to an embodiment of the present application;

[0047] Figure 7 The present invention is a schematic diagram of the device structure of the hardware operating environment involved in the access control list-based layer 2 protocol transparent transmission method in the embodiment of the present application.

[0048] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0050] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0051] The main solutions of the embodiments of this application are:

[0052] As the scale of enterprises continues to expand and network applications become increasingly complex, higher requirements are placed on network transmission technology. Traditional network transmission methods often face many challenges when facing large-scale data transmission and multi-service integration. Currently, VLAN and QinQ Layer 2 protocol transparent transmission are common technologies in the network, but there is still a disadvantage that maintaining QinQ or configuring multiple VLANs may complicate network management, which in turn requires additional network planning and maintenance.

[0053] This application provides a solution that filters target network messages through the access control list function and quickly excludes irrelevant messages based on the media access control address of the message, reducing the processing and analysis burden, thereby reducing configuration errors and management complexity and improving the overall data processing speed.

[0054] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a layer 2 protocol transparent transmission device based on an access control list, etc. The following takes the layer 2 protocol transparent transmission system based on an access control list as an example to illustrate this embodiment and the following embodiments.

[0055] Based on this, the embodiment of the present application provides a layer 2 protocol transparent transmission method based on an access control list, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the layer 2 protocol transparent transmission method based on access control list of the present application.

[0056] In this embodiment, the access control list-based layer 2 protocol transparent transmission method includes steps S10 to S30:

[0057] Step S10: Filter out network messages that meet preset conditions based on the access control list rules.

[0058] It should be noted that Access Control List (ACL) is a network security tool, which is usually used to define a series of rules on network devices (such as routers, switches, firewalls, etc.) to control the inbound and outbound traffic of data packets. ACL can allow or deny the transmission of data packets based on a variety of conditions, including but not limited to: source Internet Protocol (IP) address, destination IP address, source port number, destination port number, protocol type, direction and time. ACL rules are usually executed in sequence. Once a rule is matched, the corresponding action (allow or deny) will be executed immediately without checking subsequent rules. This feature requires network administrators to carefully plan the order of rules when configuring ACL to ensure the correct implementation of security policies.

[0059] In addition, the main functions and applications of ACL include: traffic filtering (control whether certain types of traffic can enter or leave the network), network security (prevent unauthorized access and potential network attacks), network management (manage access to network resources, improve network manageability and efficiency), and quality of service (prioritize certain types of traffic to ensure network performance for key businesses). In addition, ACL can be applied to the application layer, network layer, and data link layer.

[0060] Understandably, properly configuring and using ACLs is critical to maintaining network security and optimizing network performance.

[0061] In addition, a network message refers to a unit of data transmitted in a computer network. It includes all the necessary information to enable data to be effectively transmitted and understood between different devices in the network. It usually includes a header: it contains control information of the message, such as source address, destination address, transmission protocol type, message length, etc. The information in the header is used to guide the routing and processing of the message; data payload: also known as effective payload, which is the actual data transmitted by the message, which can be a file, message, instruction, etc.; tail: in some protocols, the tail may contain a checksum or other control information for error detection; frame check sequence (FCS): in the data link layer, such as Ethernet frames, the tail usually contains FCS, which is used to detect whether errors occur during the transmission of the message.

[0062] In addition, the preset conditions are set by the user according to the needs. Based on the access control list, it can be determined whether the network message meets the preset conditions according to the destination media access control (MAC) address of the network message. If it does not meet the preset conditions, the network message will be passed to other modules for processing. It should be noted that other modules, that is, other modules of the Layer 2 protocol transparent transmission system based on the access control list of this application, include flow control modules, quality of service (QoS) modules, etc.; if it meets the preset conditions, the message will be processed in the following steps.

[0063] Specifically, whether the network message meets the preset conditions is screened through ACL rules. This is a network security technology used to control the network messages entering and leaving network devices. ACL can define a series of rules. These rules decide whether to allow or deny the transmission of network messages based on various attributes of network messages. Such rules can specify the matching conditions of network messages, such as source IP address, destination IP address, port number, protocol type, etc.

[0064] Step S20: If the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, adjust the destination media access control address of the network message to the multicast media access control address configured by the user, and add a mapping field to the multicast media access control address configured by the user.

[0065] It should be noted that, in order to simplify the concept, the destination MAC address of the network message that meets the preset conditions above is only divided into the MAC address of the Layer 2 protocol message and the multicast MAC address configured by the user. If the destination media access control address of the network message is the multicast media access control address configured by the user, the corresponding media access control address of the Layer 2 protocol message is obtained according to the mapping field of the network message; the destination media access control address of the network message is restored to the destination media access control address of the corresponding Layer 2 protocol message, and the mapping field of the network message is deleted.

[0066] In addition, in computer networks, the destination MAC address of a network message refers to the destination address field in the data link layer frame structure. This field is used to identify the recipient of the network frame, that is, the device to which the network frame should be delivered.

[0067] In addition, in computer networks, Layer 2 protocol messages usually refer to messages transmitted at the data link layer of the OSI model, which includes Ethernet frames. The MAC address of a Layer 2 protocol message is a data link layer address, which is used for device communication within a local area network.

[0068] In addition, user-configured multicast MAC addresses usually refer to multicast MAC addresses manually set on network devices. These addresses are used to identify specific multicast groups. In Layer 2 networks, multicast MAC addresses are used to ensure that data frames can be correctly distributed to all network devices interested in the multicast stream. The composition of multicast MAC addresses follows specific rules. For IPv4 multicast addresses, the upper 24 bits of its MAC address are fixed (0x01005E), the 25th bit is fixed to 0, and the lower 23 bits come from the lower 23 bits of the IPv4 multicast address. For example, the multicast MAC address corresponding to the IPv4 multicast address 224.0.1.1 is 01-00-5E-00-01-01. This mapping mechanism allows network devices to identify and process multicast traffic, even if the mapping of multiple multicast addresses to the same MAC address needs to be processed at the physical network level. In actual applications, users may manually configure multicast MAC addresses based on the design and needs of the network in order to implement specific multicast traffic forwarding strategies on network devices. This usually involves configuring on a switch or router to specify which ports should receive and forward frames destined for a specific multicast MAC address. Configuring static multicast MAC addresses can be used to fine-tune the distribution of multicast traffic, especially in scenarios where network performance needs to be optimized or specific security requirements need to be met. For example, static multicast MAC addresses can be configured on a switch to ensure that only specific ports receive data from a specific multicast group, thereby reducing unnecessary traffic and potential security risks.

[0069] It is understandable that user-configured multicast MAC addresses are important parameters used on network devices to identify and process multicast traffic, and they play a key role in achieving efficient and secure multicast communications.

[0070] In addition, the mapping field is a tag-length-value (TLV) field, which is a widely used encoding format in the field of data communication. It consists of three main parts: type, length and value. This format is used in many scenarios such as network protocols, smart cards, IoT devices, and electronic payment systems.

[0071] In addition, the system will determine whether the Layer 2 protocol message transparent transmission function is enabled; if the Layer 2 protocol message transparent transmission function is enabled, the mapping field of the multicast media access control address configured by the user is added or deleted. Specifically, if the user enables the Layer 2 protocol transparent transmission function in the command line or on the page, the Layer 2 protocol message will add the TLV field when entering the backbone network, and delete the TLV field when leaving the backbone network; if the function is not enabled, the Layer 2 protocol message will not be transparently transmitted.

[0072] In addition, the backbone network is the most core and critical part of the entire network system. It is responsible for connecting multiple subnets or local area networks (LANs) and providing high-speed data transmission paths. The backbone network usually has the characteristics of high bandwidth, high reliability and low latency to ensure that network traffic can be transmitted efficiently and stably.

[0073] It can be understood that the role of the TLV field is to allow the multicast MAC address configured by the user to be mapped to the MAC addresses of multiple protocol messages, which simplifies the user configuration process and reduces management complexity; the role of adding the TLV field is to allow the function of the message to be expanded, new information or options to be added, while maintaining backward compatibility; the role of deleting the TLV field is to remove data that is no longer needed, restore the message size to be consistent with the original message, and reduce the network burden.

[0074] Specifically, after screening the network packets that meet the preset conditions, the system will determine the type of the destination MAC address of the network packet. If the destination MAC address of the network packet is the MAC address of the Layer 2 protocol packet, the destination MAC address of the network packet will be replaced with the multicast MAC address configured by the user, and a TLV field will be added to the end of the network packet, thereby completing the step of the Layer 2 protocol packet entering the backbone network; if the destination MAC address of the network packet is the multicast MAC address configured by the user, the MAC address of the corresponding Layer 2 protocol packet is obtained according to the TLV field at the end of the network packet, and then the destination MAC address of the network packet is replaced with the MAC address of the corresponding Layer 2 protocol packet, and the TLV field at the end of the network packet is deleted, thereby completing the step of the Layer 2 protocol packet leaving the backbone network.

[0075] In a feasible implementation manner, specific reference may be made to Figure 2 , before step S20, steps A11 to A12 may also be included:

[0076] Step A11: If the multicast media access control address configured by the user matches the multicast media access control address of the target protocol, the user is prompted to reconfigure the multicast media access control address.

[0077] It should be noted that as long as the multicast MAC address configured by the user does not conflict with the multicast MAC address of well-known protocols (such as Spanning Tree Protocol (Spanning Tree Protocol, STP), Link Layer Discovery Protocol (Link Layer Discovery Protocol, LLDP), Link Aggregation Control Protocol (Link Aggregation Control Protocol, LACP), etc.), it will not be identified as a well-known protocol by the backbone network edge device, thereby avoiding sending these messages to the central processing unit (Central Processing Unit, CPU) for processing. In order to ensure that the multicast MAC address configured by the user is valid, it is necessary to verify it. If it matches the multicast MAC address of any well-known protocol, the user is prompted to reconfigure it.

[0078] Step A12: If the multicast media access control address configured by the user does not match the multicast media access control address of the target protocol, the step of adjusting the destination media access control address of the network message to the multicast media access control address configured by the user is performed.

[0079] It is understandable that when it is found through verification that the multicast MAC address configured by the user does not conflict with the multicast MAC address of the well-known protocol, the subsequent steps can be executed.

[0080] In a specific implementation, the system can verify whether the multicast media access control address configured by the user is valid, which lays a solid foundation for the subsequent steps.

[0081] Step S30: forwarding the network message with the adjusted mapping field to the next level network.

[0082] It should be noted that the next-level network includes but is not limited to the next-level network devices connected to the network devices of the system, and the network devices include but are not limited to switches.

[0083] In addition, the network messages with adjusted mapping fields include network messages with added mapping fields and network messages with deleted mapping fields, that is, "restoring the destination media access control address of the network message to the destination media access control address of the corresponding layer 2 protocol message, and deleting the mapping field of the network message" in the above text, and the network message with deleted mapping fields will also be forwarded to the next level network.

[0084] In addition, the system will detect the integrity of the adjusted network message and the validity of the destination media access control address of the adjusted network message; if the adjusted network message is complete and the destination media access control address of the adjusted network message is valid, the adjusted network message is allowed to be forwarded to the next level network.

[0085] Specifically, the detection of network message integrity includes frame synchronization (ensuring the synchronization of data frames with the physical layer so as to correctly parse the start and end of the frame), checking the frame start flag (verifying the frame start flag to ensure that the start of the frame is correctly identified), checking the frame check sequence (checking the frame check sequence, which is calculated by cyclic redundancy check and is used to detect whether errors occur during frame transmission), frame length check (confirming whether the frame length complies with Ethernet standards, such as a minimum of 64 bytes and a maximum of 1518 bytes), checking the physical layer signal quality (evaluating the signal quality of the physical layer, such as signal attenuation, noise, etc., to ensure the reliability of data transmission); and detecting the validity of the destination MAC address of the network message includes destination MAC address check (verifying whether the destination MAC address is a unicast, broadcast or valid multicast address), source MAC address check (checking whether the source MAC address is valid to ensure that the frame comes from a legitimate device), MAC address table query (looking up the destination MAC address in the switch's MAC address table to determine whether the frame should be forwarded), VLAN tag check (if the frame carries a VLAN tag, check whether the tag is valid and whether it matches the VLAN configuration of the port), and security policy check (checking whether the MAC address is allowed to pass according to the security policy, such as the MAC address filter list).

[0086] It can be understood that integrity detection can avoid the spread of invalid data and improve network reliability. Validity detection can reduce unnecessary frame forwarding, improve network transmission efficiency, and enhance network security.

[0087] This embodiment provides a layer 2 protocol transparent transmission method based on an access control list, which filters out network messages that meet preset conditions based on the access control list rules; if the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, the destination media access control address of the network message is adjusted to the multicast media access control address configured by the user, and a mapping field is added to the multicast media access control address configured by the user; the network message with the adjusted mapping field is forwarded to the next level network. This embodiment filters the target network message through the access control list function, and quickly excludes irrelevant messages based on the media access control address of the message, reducing the processing and analysis burden, thereby reducing configuration errors and management complexity, and improving the overall data processing speed.

[0088] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 3 , before S20, steps S201 to S203 may be included:

[0089] Step S201, defining the field type, field length and field value in the network message.

[0090] It should be noted that in this application, the two devices entering and leaving the backbone network need to agree on the relationship between the TLV field and the protocol message, which can be set according to the following rules: Field type (Type): clarify the type identifier of each TLV field and ensure that all participating devices understand the meaning of these identifiers. For example, type 1 can be defined as "source address" and type 2 can be defined as "destination address" to facilitate consistent identification and parsing of field contents; Field length (Length): specify the length format of each TLV field, and a fixed length or variable length scheme can be selected. In order to improve the compactness of the message, it is recommended to control the field length to 1 byte, which can meet most application requirements and effectively save the total size of the message; Field value (Value): define the specific format and syntax of the value of each TLV field. For example, value 1 can be defined as STP protocol, value 2 can be defined as LLDP protocol, value 3 can be defined as LACP protocol, and so on. This definition method enables devices to clearly identify and process different protocol types, thereby ensuring the correct transmission and parsing of data.

[0091] Step S202: establishing a correspondence between the network message and the media access control address of the layer 2 protocol message according to the defined network message.

[0092] It should be noted that, according to the network message after defining the field type, field length and field value, a correspondence between the network message and the media access control address of the layer 2 protocol message can be established, and the correspondence is the key to the subsequent steps.

[0093] Step S203: determining the media access control address of the layer 2 protocol message corresponding to the mapping field of the network message according to the corresponding relationship.

[0094] It should be noted that, based on the corresponding relationship, the media access control address of the Layer 2 protocol message corresponding to the mapping field of the network message can be determined. In this way, if multiple protocol messages enter the backbone network at the same time and the multicast MAC address configured by the user is the same, at the backbone network exit, the mapping relationship of these TLV fields can be used to accurately restore them to their original protocol messages.

[0095] In this embodiment, the field type, field length and field value in the network message are defined; according to the defined network message, a correspondence between the media access control address of the network message and the layer 2 protocol message is established; according to the correspondence, the media access control address of the layer 2 protocol message corresponding to the mapping field of the network message is determined, and the multicast MAC address can be reused by introducing the TLV field, thereby reducing unknown multicast traffic, simplifying user configuration and reducing management complexity.

[0096] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the first and second embodiments can be referred to the above description, and will not be described in detail later. Figure 4 , step S10 also includes steps S101 to S105:

[0097] Step S101, determining an access control list rule regarding a destination media access control address of a network message.

[0098] It should be noted that this step is to define the ACL rule: create an ACL rule for the destination MAC address, which will restrict the forwarding of network packets.

[0099] Step S102: extracting a destination media access control address from a message frame of the network message.

[0100] It should be noted that the message frame is one of the basic units for transmitting data in the network, especially in the data link layer. In computer networks, after data is encapsulated at the network layer (such as the IP layer), it will be further encapsulated into frames at the data link layer for transmission on the physical medium. The message frame usually includes a frame start flag, a destination MAC address, a source MAC address, a type / length field, a data payload, and a frame check sequence.

[0101] In addition, the destination MAC address is extracted from the message frame. Specifically, in an Ethernet frame, the destination MAC address is usually in the first 6 bytes of the frame header.

[0102] Step S103: compare the extracted destination media access control address with the rules in the access control list one by one.

[0103] It should be noted that the created ACL is applied to the specific interface of the network device. In this way, when the data frame arrives at the interface, the device will check the destination MAC address of the frame according to the rules in the ACL.

[0104] Step S104: if a matching rule is found, it is determined that the network message meets the preset condition.

[0105] It should be noted that once a matching rule is found, it is determined that the network message meets the preset condition and the network message is marked.

[0106] Step S105, filtering out network messages that meet preset conditions.

[0107] It should be noted that the information of the network message that meets the preset conditions is obtained, and the type of the destination media access control address is then determined for the network message that meets the preset conditions.

[0108] This embodiment determines an access control list rule about a destination media access control address of a network message; extracts the destination media access control address from a message frame of the network message; compares the extracted destination media access control address with the rules in the access control list one by one; if a matching rule is found, it is determined that the network message meets a preset condition; and the network messages meeting the preset condition are screened out. By screening the network messages through ACL rules, the target MAC address can be quickly identified, thereby improving the screening efficiency of the Layer 2 protocol messages.

[0109] For example, in order to help understand the implementation process of the access control list-based layer 2 protocol transparent transmission method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 5 , Figure 5 A brief flow chart of a Layer 2 protocol transparent transmission method based on an access control list is provided, specifically:

[0110] When the system receives a network message, it will screen the network message based on the set ACL rules. If the destination MAC address of the network message does not meet the preset conditions in the ACL rules, the network message will be submitted to other modules in the system for processing; if it meets the preset conditions, the type of the destination MAC address of the network message will be determined;

[0111] If the destination MAC address of the network message is the MAC address of the Layer 2 protocol message, the destination MAC address of the network message is adjusted to the multicast MAC address configured by the user, and a mapping field is added to the multicast MAC address configured by the user, and finally the network message with the added mapping field is forwarded to the next level network; if the destination MAC address of the network message is the multicast MAC address configured by the user, the corresponding MAC address of the Layer 2 protocol message is obtained according to the mapping field of the network message, and the destination MAC address of the network message is restored to the destination MAC address of the corresponding Layer 2 protocol message, and the mapping field of the network message is deleted, and finally the network message with the mapping field deleted is forwarded to the next level.

[0112] It is understandable that since different network messages usually have different destination MAC addresses, we only need to focus on the destination MAC of the message, use the ACL function to filter specific network messages, quickly exclude irrelevant messages, and make corresponding adjustments based on the specific destination MAC address of the network message, and control the forwarding of the adjusted network message to the next level network, which simplifies the user configuration process and reduces management complexity.

[0113] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the Layer 2 protocol transparent transmission method based on the access control list of the present application. More forms of simple transformations based on this technical concept are all within the scope of protection of the present application.

[0114] This application also provides a layer 2 protocol transparent transmission device based on access control list, please refer to Figure 6 , the layer 2 protocol transparent transmission device based on access control list includes:

[0115] A screening module 10 is used to screen out network messages that meet preset conditions based on access control list rules;

[0116] A judgment module 20, for adjusting the destination media access control address of the network message to a multicast media access control address configured by the user if the type of the destination media access control address of the network message is a media access control address of a layer 2 protocol message, and adding a mapping field to the multicast media access control address configured by the user;

[0117] The forwarding module 30 is used to forward the network message with the adjusted mapping field to the next level network.

[0118] The layer 2 protocol transparent transmission device based on access control list provided by the present application adopts the layer 2 protocol transparent transmission method based on access control list in the above embodiment, which can solve the technical problem of low network management efficiency of the existing layer 2 protocol transparent transmission method. Compared with the prior art, the beneficial effects of the layer 2 protocol transparent transmission device based on access control list provided by the present application are the same as the beneficial effects of the layer 2 protocol transparent transmission method based on access control list provided by the above embodiment, and other technical features in the layer 2 protocol transparent transmission device based on access control list are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0119] In one embodiment, the screening module 10 is also used to obtain the corresponding media access control address of the Layer 2 protocol message according to the mapping field of the network message if the destination media access control address of the network message is a multicast media access control address configured by the user; restore the destination media access control address of the network message to the destination media access control address of the corresponding Layer 2 protocol message, and delete the mapping field of the network message.

[0120] In one embodiment, the screening module 10 is also used to define the field type, field length and field value in the network message; based on the defined network message, a correspondence between the network message and the media access control address of the layer 2 protocol message is established; the step of obtaining the corresponding media access control address of the layer 2 protocol message based on the mapping field of the network message includes: determining the media access control address of the layer 2 protocol message corresponding to the mapping field of the network message based on the corresponding relationship.

[0121] In one embodiment, the screening module 10 is also used to determine the access control list rules regarding the destination media access control address of the network message; extract the destination media access control address from the message frame of the network message; compare the extracted destination media access control address with the rules in the access control list one by one; if a matching rule is found, it is determined that the network message meets the preset conditions; and the network messages that meet the preset conditions are screened out.

[0122] In one embodiment, the judgment module 20 is also used to remind the user to reconfigure the multicast media access control address if the multicast media access control address configured by the user matches the multicast media access control address of the target protocol; if the multicast media access control address configured by the user does not match the multicast media access control address of the target protocol, then the step of adjusting the destination media access control address of the network message to the multicast media access control address configured by the user is executed.

[0123] In one embodiment, the screening module 10 is further used to determine whether the Layer 2 protocol message transparent transmission function is enabled; when the Layer 2 protocol message transparent transmission function is enabled, the mapping field of the multicast media access control address configured by the user is added or deleted.

[0124] In one embodiment, the forwarding module 30 is further used to detect the integrity of the network message with the mapping field adjusted, and to detect the validity of the destination media access control address of the network message with the mapping field adjusted;

[0125] If the network message with the mapping field adjusted is complete and the destination media access control address of the network message with the mapping field adjusted is valid, the network message with the mapping field adjusted is allowed to be forwarded to the next level network.

[0126] The present application provides a Layer 2 protocol transparent transmission device based on an access control list, and the Layer 2 protocol transparent transmission device based on an access control list includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the Layer 2 protocol transparent transmission method based on the access control list in the above-mentioned embodiment 1.

[0127] Reference below Figure 7 , which shows a schematic diagram of the structure of a Layer 2 protocol transparent transmission device based on an access control list suitable for implementing the embodiment of the present application. The Layer 2 protocol transparent transmission device based on an access control list in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The access control list-based layer 2 protocol transparent transmission device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0128] like Figure 7As shown, the layer 2 protocol transparent transmission device based on the access control list may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 to the random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the layer 2 protocol transparent transmission device based on the access control list are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the access control list-based layer 2 protocol transparent transmission device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows the access control list-based layer 2 protocol transparent transmission device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0129] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0130] The layer 2 protocol transparent transmission device based on access control list provided by the present application adopts the layer 2 protocol transparent transmission method based on access control list in the above embodiment, which can solve the technical problem of low network management efficiency of the existing layer 2 protocol transparent transmission method. Compared with the prior art, the beneficial effect of the layer 2 protocol transparent transmission device based on access control list provided by the present application is the same as the beneficial effect of the layer 2 protocol transparent transmission method based on access control list provided by the above embodiment, and the other technical features in the layer 2 protocol transparent transmission device based on access control list are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0131] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0132] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0133] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the access control list-based layer 2 protocol transparent transmission method in the above-mentioned embodiment.

[0134] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0135] The computer-readable storage medium may be included in the layer 2 protocol transparent transmission device based on the access control list; or may exist independently without being assembled into the layer 2 protocol transparent transmission device based on the access control list.

[0136] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by a layer 2 protocol transparent transmission device based on an access control list, the layer 2 protocol transparent transmission device based on the access control list: filters out network messages that meet preset conditions based on access control list rules; if the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, adjusts the destination media access control address of the network message to a multicast media access control address configured by the user, and adds a mapping field to the multicast media access control address configured by the user; and forwards the network message with the adjusted mapping field to the next-level network.

[0137] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0138] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0139] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0140] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned layer 2 protocol transparent transmission method based on access control lists, and can solve the technical problem of low network management efficiency of the existing layer 2 protocol transparent transmission method. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the layer 2 protocol transparent transmission method based on access control lists provided by the above-mentioned embodiments, and will not be repeated here.

[0141] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned access control list-based layer 2 protocol transparent transmission method.

[0142] The computer program product provided by the present application can solve the technical problem of low network management efficiency of the existing layer 2 protocol transparent transmission method. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the layer 2 protocol transparent transmission method based on access control lists provided in the above embodiments, and will not be described in detail here.

[0143] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A layer 2 protocol transparent transmission method based on access control list, characterized in that: The method comprises: Filter out network messages that meet preset conditions based on access control list rules; If the type of the destination media access control address of the network message is the media access control address of the layer 2 protocol message, adjusting the destination media access control address of the network message to a multicast media access control address configured by the user, and adding a mapping field to the multicast media access control address configured by the user; Forward the network message with the adjusted mapping field to the next level network; After the step of filtering out network messages that meet preset conditions based on the access control list rules, the method further includes: If the destination media access control address of the network message is a multicast media access control address configured by the user, obtaining the corresponding media access control address of the layer 2 protocol message according to the mapping field of the network message; Restoring the destination media access control address of the network message to the destination media access control address of the corresponding layer 2 protocol message, and deleting the mapping field of the network message; Before the step of obtaining the media access control address of the corresponding layer 2 protocol message according to the mapping field of the network message, the method further includes: Defining the field type, field length and field value in the network message; According to the defined network message, a corresponding relationship between the network message and the media access control address of the layer 2 protocol message is established; The step of obtaining the media access control address of the corresponding layer 2 protocol message according to the mapping field of the network message comprises: The media access control address of the layer 2 protocol message corresponding to the mapping field of the network message is determined according to the corresponding relationship.

2. The method according to claim 1, characterized in that The step of filtering out network messages that meet preset conditions based on the access control list rules includes: Determining access control list rules regarding a destination media access control address of a network message; Extracting a destination media access control address from a message frame of the network message; Comparing the extracted destination media access control address with the rules in the access control list one by one; If a matching rule is found, it is determined that the network message meets the preset condition; Filter out network messages that meet the preset conditions.

3. The method according to claim 1, characterized in that Before the step of adjusting the destination media access control address of the network message to the multicast media access control address configured by the user, the method further includes: If the multicast media access control address configured by the user matches the multicast media access control address of the target protocol, prompting the user to reconfigure the multicast media access control address; If the multicast media access control address configured by the user does not match the multicast media access control address of the target protocol, the step of adjusting the destination media access control address of the network message to the multicast media access control address configured by the user is performed.

4. The method according to claim 1 or 2, characterized in that: Before the step of adding a mapping field to the multicast media access control address configured by the user, the method further includes: Determine whether the Layer 2 protocol message transparent transmission function is enabled; When the layer 2 protocol message transparent transmission function is enabled, the mapping field of the multicast media access control address configured by the user is added or deleted.

5. The method according to claim 1, characterized in that The step of forwarding the network message with the adjusted mapping field to the next level network includes: Detecting the integrity of the network message with the mapping field adjusted, and detecting the validity of the destination media access control address of the network message with the mapping field adjusted; If the network message with the mapping field adjusted is complete and the destination media access control address of the network message with the mapping field adjusted is valid, the network message with the mapping field adjusted is allowed to be forwarded to the next level network.

6. A layer 2 protocol transparent transmission device based on access control list, characterized in that: The layer 2 protocol transparent transmission device based on the access control list includes: A screening module is used to screen out network messages that meet preset conditions based on access control list rules; A judgment module, configured to adjust the destination media access control address of the network message to a multicast media access control address configured by the user if the type of the destination media access control address of the network message is a media access control address of a layer 2 protocol message, and add a mapping field to the multicast media access control address configured by the user; A forwarding module, used for forwarding the network message with the adjusted mapping field to the next level network; The screening module is further used for obtaining the corresponding media access control address of the layer 2 protocol message according to the mapping field of the network message if the destination media access control address of the network message is a multicast media access control address configured by the user; restoring the destination media access control address of the network message to the destination media access control address of the corresponding layer 2 protocol message, and deleting the mapping field of the network message; The screening module is further used to define the field type, field length and field value in the network message; and to establish a corresponding relationship between the network message and the media access control address of the layer 2 protocol message according to the defined network message; The screening module is further used to determine the media access control address of the layer 2 protocol message corresponding to the mapping field of the network message according to the corresponding relationship.

7. A layer 2 protocol transparent transmission device based on access control list, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the access control list-based layer 2 protocol transparent transmission method as described in any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the access control list-based layer 2 protocol transparent transmission method according to any one of claims 1 to 5 are implemented.

Images