Message forwarding method and device, storage medium and computer program product

Abstract

The invention relates to the technical field of network security, in particular to a message forwarding method and device, a storage medium and a computer program product. The forwarding method is applied to network equipment and comprises the following steps: receiving a network address hopping request from a first network node; acquiring a second network address of the first network node after network address hopping based on the network address hopping request; a message with the target network address being a first network address is received, and the first network address is a corresponding network address of the first network node before network address hopping; determining a second network node meeting a preset condition; and based on the second network address, the second network node and the message, forwarding the message to the first network node of which the network address jumps to the second network address through the second network node. According to the method and the device, the network address of the network node is dynamically changed, and the appropriate transfer node is selected to send the message to the first network node after the network address hopping, so that the APT attack is effectively defended.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a message forwarding method, device, storage medium and computer program product. Background Art

[0002] Advanced Persistent Threat (APT) refers to a continuous and effective attack activity launched by an organization against a specific target, which is highly concealed and targeted.

[0003] In the process of message forwarding, the existing traditional defense methods such as anti-virus software, firewalls, intrusion detection, etc. can improve the network defense capabilities, but they cannot effectively resist APT attacks. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a message forwarding method, device, storage medium and computer program product.

[0005] According to one aspect of the present disclosure, the present disclosure provides a message forwarding method, which is applied to a network device, including: receiving a network address jump request from a first network node; based on the network address jump request, obtaining a second network address of the first network node after the network address jump; receiving a message whose target network address is the first network address, wherein the first network address is the corresponding network address of the first network node before the network address jump; determining a second network node that meets a preset condition; and based on the second network address, the second network node and the message, forwarding the message to the first network node whose network address jumps to the second network address through the second network node.

[0006] In addition, according to an aspect of the message forwarding method disclosed herein, a network device includes a layer-3 gateway and at least two layer-2 gateways connected to the layer-3 gateway; based on a network address jump request, a second network address of a first network node after a network address jump is obtained, including: the layer-3 gateway determines load information of at least two layer-2 gateways based on the network address jump request; the layer-3 gateway determines whether to perform a network address jump based on the load information of at least two layer-2 gateways; in the case of performing a network address jump, the first layer-2 gateway obtains the second network address of the first network node after the network address jump, wherein the first layer-2 gateway is a gateway among the at least two layer-2 gateways, and the first layer-2 gateway is connected to the first network node.

[0007] In addition, according to a message forwarding method according to one aspect of the present disclosure, determining a second network node that meets preset conditions includes: based on the load information of all network nodes connected to the first layer 2 gateway, determining whether there is a set of network nodes whose storage load is less than a storage load threshold; when there is a set of network nodes whose storage load is less than the storage load threshold, based on the network node set, determining that the network node with the smallest computing resource load value is the second network node.

[0008] In addition, according to the message forwarding method of one aspect of the present disclosure, determining the second network node that meets the preset conditions also includes: when there is no network node set whose storage load is less than the storage load threshold, based on the load information of the three-layer gateway, determining the second two-layer gateway with the smallest load rate value among at least two two-layer gateways; based on the load information of all network nodes connected to the second two-layer gateway, determining the network node set whose storage load is less than the storage load threshold; based on the network node set, determining the network node with the smallest computing resource load value as the second network node.

[0009] In addition, according to the message forwarding method of one aspect of the present disclosure, the calculation formula for calculating the resource load value is: ICPU+IGPU; wherein ICPU is the CPU idle rate of the second network node, and IGPU is the GPU idle rate of the second network node.

[0010] In addition, according to a message forwarding method according to one aspect of the present disclosure, a G flag and an E flag are added to the message header of the VxLAN message; wherein, when G is 1, it indicates that the micro-segmentation function is enabled, and when G is 0, it indicates that the micro-segmentation function is not enabled; when E is 1, it indicates that the network address hopping is enabled, and the second network address is stored in the NEW IP field; when E is 0, it indicates that the network address hopping is not enabled.

[0011] In addition, according to one aspect of the present disclosure, a message forwarding method, the message is a virtual extended local area network VxLAN message; based on the second network address, the second network node and the message, the message is forwarded through the second network node to the first network node whose network address jumps to the second network address, including: modifying the message header of the VxLAN message, adding a new field NEW IP field, the NEW IP field is used to store the second network address, and forming a new VxLAN message; determining the network identification information of the second network node; based on the network identification information, sending the new VxLAN message to the second network node; based on the second network address, forwarding the payload carried by the new VxLAN message sent to the second network node to the first network node whose network address jumps to the second network address.

[0012] In addition, according to the message forwarding method of one aspect of the present disclosure, the load information includes storage load, CPU idle rate, GPU idle rate and storage threshold.

[0013] According to another aspect of the present disclosure, a message forwarding device is provided, including: a jump request module, configured to receive a network address jump request from a first network node; a jump module, configured to obtain, based on the network address jump request, a second network address of the first network node after the network address jump; a message receiving module, configured to receive a message whose target network address is a first network address, wherein the first network address is the network address of the first network node before the network address jump; a network node determination module, configured to determine a second network node that meets a preset condition; and a message forwarding module, configured to forward the message to the first network node whose network address jumps to the second network address through the second network node based on the second network address, the second network node and the message.

[0014] In addition, according to the network address jumping device of another aspect of the present disclosure, the jumping module is also configured to: determine the load information of all network nodes connected to the network device based on the network address jumping request; determine whether to perform network address jumping based on the load information of all network nodes; and when performing network address jumping, obtain the second network address of the first network node after the network address jump.

[0015] According to another aspect of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the message forwarding method as described above when executing the computer program.

[0016] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the message forwarding method as described above is implemented.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the message forwarding method as described above is implemented.

[0018] As described in detail below, the message forwarding method, device, storage medium and computer program product according to the embodiments of the present disclosure are described in detail. The present disclosure dynamically changes the network address of the network node and selects a suitable transfer node (second network node) to send the message to the first network node after the network address jump, thereby ensuring the communication quality and increasing the difficulty for attackers to identify and attack targets, thereby effectively defending against APT attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is a flowchart illustrating a message forwarding method provided according to an embodiment of the present disclosure.

[0021] Figure 2 It is a flowchart further illustrating the message forwarding method provided according to an embodiment of the present disclosure.

[0022] Figure 3 It is a schematic diagram illustrating the format of existing VxLAN messages.

[0023] Figure 4 FIG. 8 is a schematic diagram of the VxLAN header of the modified VxLAN message.

[0024] Figure 5 It is a schematic diagram of the communication system architecture that illustrates the application of the message forwarding method provided by the embodiment of the present disclosure.

[0025] Figure 6 Detailed description is a functional block diagram of a network address jumping device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the technical solutions in the present disclosure will be clearly and completely described below in conjunction with the drawings in the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0027] Figure 1 It is a flowchart illustrating a message forwarding method according to an embodiment of the present disclosure.

[0028] like Figure 1 As shown, the message forwarding method according to the embodiment of the present disclosure is executed by a network device and specifically includes the following steps.

[0029] Among them, network equipment generally refers to hardware or software entities that perform data transmission, forwarding, processing or other network functions in the network. These devices may include routers, switches, firewalls, load balancers, servers, etc. Responsible for transmitting messages in the network and routing, forwarding or processing messages according to network protocols and policies. In the method of the embodiment of the present disclosure, the network device may include a Layer 3 Gateway (L3 GW) and at least two Layer 2 Gateways (L2 GW) connected to the Layer 3 Gateway, which are responsible for receiving network address hopping requests, performing address hopping operations, and forwarding messages.

[0030] Step S101: receiving a network address change request from a first network node.

[0031] In one embodiment of the present disclosure, the first network node refers to any device with network functions, such as a computer, server, router, switch, etc. The first network node monitors and analyzes its own traffic. When it detects that the traffic on a certain port suddenly surges and far exceeds the normal level; or detects traffic of non-standard or unknown protocols, it means that hackers may be trying to exploit unknown vulnerabilities or conduct malicious scans. At this time, the first network device node will send a network address jump request to the network device.

[0032] In one embodiment of the present disclosure, the first network node may also send a network address hopping request to the L2 GW connected thereto, and after receiving the network address hopping request, the L2 GW uploads the network address hopping request to the L3GW.

[0033] Step S102: based on the network address jump request, obtaining a second network address of the first network node after the network address jump.

[0034] In one embodiment of the present disclosure, the second network address refers to a new network address used for communication in the network after the first network node undergoes a network address jump. After receiving a network address jump request, the network device will send a jump request response to the first network node if it determines that the jump is allowed, informing the first network node that its network address jump request has been accepted. After receiving the jump request response, the first network node will jump the original network address of the first network node to the second network address, and send the second network address to the network device, so that the network device obtains the new network address of the first network node after the network address jump, that is, the second network address.

[0035] In one embodiment of the present disclosure, the first network node sends a network address jump request to the L2 GW connected to it. After receiving the network address jump request, the L2 GW will upload the network address jump request to the L3 GW. After receiving the network address jump request, if the L3GW determines that the jump is allowed, the L3GW informs the layer 2 gateway connected to the first network node that the network address jump is allowed. Then, the layer 2 gateway sends a jump request response to the first network node to inform the first network node that its network address jump request has been accepted. After receiving the jump request response, the first network node will jump the original network address of the first network node to the second network address, and send the second network address to the L2GW, so that the L2GW obtains the new network address of the first network node after the network address jump, that is, the second network address.

[0036] For example, it is assumed that the first network node initiates a network address jump request at time t1, and its original IP (i.e., original network address) is defined as OLD_IP. If the first network node receives an IP jump request response, the IP address jump process is started. It is assumed that the first network node receives a jump request response at time t2, first obtains the UNIX timestamp at time t2, and then generates a 32-byte result through the following formula (2), and intercepts the first 2 bytes (16 bits) as NEW_IP (i.e., the second network address). The NEW_IP is uploaded to the L2 GW for storage.

[0037] Where, formula (2): .

[0038] Step S103: receiving a message whose target network address is a first network address, wherein the first network address is a network address of the first network node before the network address changes.

[0039] In one embodiment of the present disclosure, the target network address refers to the destination address of the message during transmission. The first network address is the network address used for communication in the network by the first network node before performing the network address jump. The first network node performs the network address jump operation, and its network address changes. However, although the address of the first network node has changed, there may still be messages sent to its old address (i.e., the first network address). These messages are received by the network device in step S103.

[0040] Step S104: determine a second network node that meets a preset condition.

[0041] In one embodiment of the present disclosure, the preset condition refers to a set of rules or standards set in advance under specific circumstances, and the second network node refers to any device with network functions, such as a computer, a server, a router, a switch, etc. After receiving a message whose target network address is the first network address, the network device will search for a second network node that meets the preset condition according to the preset condition.

[0042] In one embodiment of the present disclosure, the layer-2 gateway to which the first network node is connected determines the second network node that meets the preset condition.

[0043] Step S105: Based on the second network address, the second network node and the message, forward the message through the second network node to the first network node whose network address jumps to the second network address.

[0044] In one embodiment of the present disclosure, the network device will forward the message to the first network node whose network address jumps to the second network address, that is, the first network node after the network address is changed, through the found second network node based on the second network address, the second network node and the received message whose target network address is the first network address.

[0045] In summary, according to the technical solution provided by the embodiments of the present disclosure, the present disclosure dynamically changes the network address of the network node and selects a suitable transfer node (second network node) to send the message to the first network node after the network address jumps. While ensuring the communication quality, it increases the difficulty for attackers to identify and attack targets, thereby effectively defending against APT attacks.

[0046] Further, the network device includes a three-layer gateway and at least two layer-2 gateways connected to the three-layer gateway, and based on a network address jump request, obtains a second network address of the first network node after the network address jump, including: the three-layer gateway determines the load information of the at least two layer-2 gateways based on the network address jump request; the three-layer gateway determines whether to perform a network address jump based on the load information of the at least two layer-2 gateways; in the case of performing a network address jump, the first layer-2 gateway obtains the second network address of the first network node after the network address jump, wherein the first layer-2 gateway is a gateway among the at least two layer-2 gateways, and the first layer-2 gateway is connected to the first network node.

[0047] Specifically, after receiving the network address jump request, L3GW will first determine the load information of all Layer 2 gateways connected to L3GW, determine the current network status through the load information of the Layer 2 gateway, and determine whether to perform the network address jump according to the current network status. For example, through the load information, it is determined that the current network status is defined as busy, and the jump is prohibited, otherwise the jump is allowed. In the case of determining that the jump is allowed, L3GW informs the first Layer 2 gateway connected to the first network node that the network address jump is allowed. Furthermore, the first Layer 2 gateway sends a jump request response to the first network node, informing the first network node that its network address jump request has been accepted. After receiving the jump request response, the first network node will jump the original network address of the first network node to the second network address, and send the second network address to the network device, so that the network device obtains the new network address of the first network node after the network address jump, that is, the second network address.

[0048] In one embodiment of the present disclosure, L3 GW and L2 GW connected to L3GW respectively establish load information tables for subsequent load information measurement. Wherein, network node refers to any device, server, router, switch, etc. with network functions. The load information of the network node may include storage load, storage threshold, CPU idle rate, and GPU idle rate.

[0049] The formats of the L2 GW and L3 GW load information tables are shown in Table 1 and Table 2 respectively: Table 1: L2 GW load information table

[0050] Table 2: L3 GW load information table

[0051] Among them, in the load information table of L2 GW, storage load indicates the storage pressure of the network node. The higher the value, the heavier the load, which is a static indicator. The idle rate of the central processing unit CPU is represented by ICPU, and its value is between 0 and 1, 0 means completely busy, and 1 means completely idle, which is a dynamic indicator. The idle rate of the graphics processing unit GPU is represented by IGPU, and similarly, its value is between 0 and 1, 0 means completely busy, and 1 means completely idle, which is a dynamic indicator. The storage load threshold of the network node is set according to the actual application scenario.

[0052] Exemplarily, the VM1_IP and VM2_IP represent IP addresses of network nodes connected to the L2GW, and L2GW1_IP and L2GW1_IP represent IP addresses of the L2GW connected to the L3GW.

[0053] There may be multiple network nodes connected to the L2GW, and there may be multiple L2GWs connected to the L3GW, which is not limited in the present disclosure.

[0054] In the load information table of L3 GW, the load rate L3_Load_Rate indicates the load pressure of L3 GW. The larger the value, the greater the pressure. The calculation formula is: (Formula 1)

[0055] The above formula indicates that the load rate of L3 GW is the sum of the loads of all L2 GWs it contains. The formula assigns different weights to storage load, CPU busy rate, and GPU busy rate, which can be adjusted according to specific application scenarios. Assume that the weights are , and, and .

[0056] Exemplarily, after receiving the network address jump request, L3GW queries the load information table stored thereon through L3GW. If the load rate of L2GWs exceeding the load threshold accounts for more than half, the current network state is defined as busy and jump is prohibited; otherwise, jump is allowed. In the prohibited jump state, L2GW does not respond to the jump request sent by the first network node; when jump is allowed, L2GW will respond to the network address jump request of the first network node through a jump request response.

[0057] In summary, according to the technical solution provided by the embodiment of the present disclosure, the present disclosure can achieve more refined network address hopping management by evaluating the load information of the network nodes, ensuring that the hopping operation is performed at the most appropriate time. Avoid performing address hopping when the network load is high, thereby reducing the impact on network performance and optimizing resource utilization. Performing hopping when the network load is low can reduce interference with existing network services and applications and improve the stability of the network. And by performing address hopping when the load is low, the security of the network can be enhanced without affecting the user experience. Furthermore, the execution of address hopping is dynamically adjusted according to the real-time network conditions, so that the network can flexibly respond to various security threats.

[0058] Furthermore, determining the second network node that meets the preset conditions includes: based on the load information of all network nodes connected to the first layer 2 gateway, determining whether there is a set of network nodes with a storage load less than a storage load threshold; when there is a set of network nodes with a storage load less than the storage load threshold, based on the network node set, determining the network node with the smallest computing resource load value as the second network node.

[0059] Specifically, when the first layer-2 gateway receives a message whose target network address is the first network address, it will query the load information of all network nodes connected to the first layer-2 gateway through the load information table of the first layer-2 gateway, and determine whether there is a network node set whose storage load is less than the storage load threshold through the load information of the network nodes. The network node set includes at least one network node. When there is a network node set whose storage load is less than the storage load threshold, the network node with the smallest computing resource load value is selected from the network node set as the second network node.

[0060] Furthermore, when there is no network node set whose storage load is less than the storage load threshold, based on the load information of the three-layer gateway, a second layer-2 gateway with the smallest load rate value among the at least two layer-2 gateways is determined; based on the load information of all network nodes connected to the second layer-2 gateway, a network node set whose storage load is less than the storage load threshold is determined; based on the network node set, the network node with the smallest computing resource load value is determined to be the second network node.

[0061] Specifically, when the first layer-2 gateway connected to the first network node does not have a network node set whose storage load is less than the storage load threshold, the first layer-2 gateway will notify the layer-3 gateway, and the layer-3 gateway will query its load information table. The layer-3 gateway searches for the gateway with the smallest load rate value among the other layer-2 gateways connected to it according to its load information table, and the gateway with the smallest load rate value is the second layer-2 gateway. Then, the second layer-2 gateway queries its load information table to find a network node set whose storage load is less than the storage load threshold. Among them, the network node set includes at least one network node. When there is a network node set whose storage load is less than the storage load threshold, the network node with the smallest computing resource load value is selected from the network node set as the second network node, and the second layer-2 gateway notifies the first layer-2 gateway. Then, the first layer-2 gateway determines the second network node.

[0062] Exemplarily, the resource load value can be calculated by first selecting a set of network nodes whose storage load is lower than the storage load threshold through the load information table, and then selecting the network node with the smallest ICPU+IGPU as the second network node. Among them, ICPU is the CPU idle rate of the second network node, and IGPU is the GPU idle rate of the second network node. When selecting the second network node, both the CPU idle rate and the GPU idle rate are considered. Selecting the network node with the smallest sum of these two resources means selecting the network node with the lowest current overall computing resource load to ensure that subsequent forwarding operations are performed on the network node with the least tight resources, thereby minimizing the impact on network node performance and improving overall resource utilization efficiency.

[0063] In summary, according to the technical solution provided by the embodiment of the present disclosure, by selecting the network node with the smallest computing resource load value as the second network node, a balanced distribution of the network load can be achieved to avoid overloading of some nodes while idle resources of other nodes. Furthermore, by selecting the node with the highest idle rate for network address hopping, network resources can be more effectively utilized and the operating efficiency of the overall network can be improved. Furthermore, by giving priority to nodes with higher CPU and GPU idle rates, the impact on network performance can be reduced because these nodes are more likely to process additional network traffic or tasks.

[0064] Figure 2 It is a flowchart illustrating a message forwarding method according to an embodiment of the present disclosure.

[0065] like Figure 2 As shown, according to the message forwarding method of the embodiment of the present disclosure, based on the second network address, the second network node and the message, the message is forwarded through the second network node to the first network node whose network address jumps to the second network address, which specifically includes the following steps.

[0066] In step S201, the message header of the VxLAN message is modified, and a new field NEW IP field is added. The NEW IP field is used to store the second network address to form a new VxLAN message.

[0067] In one embodiment of the present disclosure, the current industry regulations on the format of VxLAN messages are as shown in FIG3. Figure 3 This is the format of the existing VxLAN message. The present invention modifies the message header of the VxLAN message, adds a new field NEW IP field in the VxLAN header part, uses the NEW IP field to store the second network address, and generates a new VxLAN message.

[0068] In one embodiment of the present disclosure, the VxLAN header of the VxLAN message may also be modified as follows. For details, see Figure 4 , Figure 4 This is a diagram of the VxLAN header of the modified VxLAN message: 1. Add the flag G, which defaults to 0. When the G flag is set to 1, it indicates that the micro-segmentation function is enabled for fine-grained access control. Micro-segmentation is a network security technology that allows the creation of smaller logical segments within the network to improve security and isolation. If the micro-segmentation function is enabled (G=1), the EPG group number to which the sender of the data packet (i.e., the message) belongs is saved in the subsequent EPG field of the VXLAN message header. The EPG field is used to identify which terminal group the sender of the data packet belongs to. If the micro-segmentation function is not enabled (G=0), the EPG field defaults to all 0s, indicating that micro-segmentation information is not used. The above modifications allow VXLAN messages to carry additional security and isolation information when transmitted in the network, so that network devices can perform more refined control over data packets based on this information.

[0069] 2. Add the flag bit E. The default value of the E flag bit is 0, which means that the function is disabled if the hopping function is not explicitly enabled. When the E flag bit is set to 1, it means that the hopping function is enabled. The hopping function allows the target network address (such as IP address) of the data packet to be dynamically changed in the network to achieve load balancing, failover or other network optimization purposes. If the hopping function is enabled (E=1), the new network address after the hopping (i.e., the second network address) is saved in the subsequent 16-bit NEW IP field of the VXLAN header. The NEW IP field is used to store the new target network address of the data packet, which can flexibly adapt to the needs of network security and traffic management. If the hopping function is not enabled (E=0), the NEW IP field defaults to all 0s, indicating that the network address is not hopping. In order to balance security and routing efficiency, only the last 16 bits of the network address are hopping. This means that the prefix of the network address remains unchanged and only the suffix changes. This method can reduce the impact on the routing table to a certain extent while providing flexibility in network addresses. The above modifications allow VxLAN packets to carry the changed IP address information when transmitted in the network, so that network devices can reroute data packets based on this information.

[0070] In step S202, network identification information of the second network node is determined.

[0071] In one embodiment of the present disclosure, network identification information refers to information used to identify and locate the second network node, including but not limited to an IP address, a MAC address, a VxLAN network identifier, etc. After the second network node is determined, the network identification information of the second network node can be determined based on the determined second network node.

[0072] In step S203, based on the network identification information, a new VxLAN message is sent to the second network node.

[0073] In one embodiment of the present disclosure, the network identification information of the second network node is used, which includes but is not limited to the IP address, MAC address and VxLAN network identifier. Exemplarily, the best path can be determined by the routing protocol based on one or more of the IP address, MAC address and VxLAN network identifier of the second network node, and the new VxLAN message is sent to the second network node. During the transmission of the new VxLAN message, the network identification information ensures that the new VxLAN message can be correctly identified and routed to the second network node.

[0074] In another embodiment of the present disclosure, according to the network identification information of the second network node, the Inner IP DA (first network address) in the new VxLAN message whose target network address Inner IP DA is Old_IP (first network address) is changed to IP_B (i.e., the IP address of the second network node), and the internal destination MAC address is changed to the MAC address of the second network node. The best path is determined by the routing protocol, and the new VxLAN message is sent to the second network node. The G and E flags in the message header of the new VxLAN message can also be set to 0, and the NEW IP field is set to NEW_IP (i.e., the second network address). Here, setting the G and E flags to 0 ensures that the micro-segmentation and hopping functions will not be enabled during the message forwarding process, thereby ensuring that the message can be correctly processed and forwarded according to the new network address and the corresponding relationship.

[0075] In step S204, based on the second network address, the payload carried by the new VxLAN message sent to the second network node is forwarded to the first network node whose network address jumps to the second network address.

[0076] In an embodiment of the present disclosure, after the network address jumps, the network address of the first network node has been changed to the second network address. Therefore, when a new VxLAN message arrives at the second network node, it is necessary to forward the payload of the new VxLAN message to the updated address, that is, the first network node after the network address jumps. After the second network node receives the new VxLAN message, the best path is determined by using the second network address through the routing protocol and the routing table, and the payload of the new VxLAN message is forwarded to the updated address, that is, the first network node after the network address jumps.

[0077] Exemplarily, according to the routing requirements of the VxLAN+micro-segmented network, the second network address is used to determine the best path, and the payload of the new VxLAN message is forwarded to the updated address, that is, the first network node after the network address jumps, to ensure the continuity and security of network communications.

[0078] In another embodiment of the present disclosure, a correspondence between the IP address of the second network node and the second network address is established. After the second network node receives a new VxLAN message, the new VxLAN message is transferred on the second network node. At this time, the second network node will upload the transfer completion signal to the L2 GW, and then the L2 GW and L3 GW will update the load information table and the flow table. Further, the L2 GW also updates the MAC address table, multicast GBP policy, and EPG grouping table stored thereon. According to the correspondence between the IP address of the second network node and NEW_IP (i.e., the second network address), the second network node re-encapsulates the new VxLAN message according to the routing rules of the VxLAN+ micro-segmented network, and forwards the payload of the new VxLAN message to the updated address, i.e., the first network node after the network address jumps. The above process ensures that the message can be correctly forwarded to the new destination even in the case of a network address jump. This mechanism can improve the flexibility and security of the network, especially when it is necessary to dynamically adjust the network topology or respond to network attacks. In this way, the network can dynamically respond to internal or external changes without interrupting service.

[0079] In summary, according to the technical solution provided by the embodiment of the present invention, the present invention modifies the VxLAN message header, adds a NEWIP field, determines the network identification information of the second network node, sends a new VxLAN message to the second network node according to the network identification information, and forwards the new VxLAN message to the first network node after the network address jump through the second network node. Through the network address jump, the flexibility and security of the network are improved, and the adaptability and security of the network in the face of attacks or topology changes are further improved, while ensuring the continuity of services and the accuracy of communications.

[0080] Figure 5 It is a schematic diagram of the communication system architecture that illustrates the application of the message forwarding method provided by the embodiment of the present disclosure.

[0081] like Figure 5 As shown, the communication system 500 includes a layer-3 gateway 501 and a first layer-2 gateway 502 and a second layer-2 gateway 503 connected to the layer-3 gateway.

[0082] The three-layer gateway 501 may include a controller module, which is used to: 1. Receive the IP hopping request and transfer end signal sent by the IP hopping module of the Layer 2 gateway connected to it (that is, after the above-mentioned VxLAN message is transferred to the second network node, the Layer 2 gateway will send a transfer end signal to the Layer 3), and transmit the IP hopping request response downward (that is, to the Layer 2 gateway).

[0083] 2. Based on the load information of the Layer 3 gateway, determine whether IP hopping is allowed.

[0084] The first layer 2 gateway 502 and the second layer 2 gateway 503 may include a load measurement module and an IP hopping module. The first layer 2 gateway 502 is connected to Host1 and Host2, and the second layer 2 gateway 503 is connected to Host3 (Host1, Host2, Host3 are the above network nodes).

[0085] The load measurement module is used to: 1. Build a load information table based on the information (i.e., load information of the network node) returned by the host's (i.e., network node) proxy module.

[0086] 2. Query the load information table to determine the load information of the network nodes connected to the Layer 2 network.

[0087] The IP hopping module is used for: 1. Receive the IP hopping request (i.e. the above network address hopping request) issued by the Host (i.e. the network node), and obtain the NEW_IP (i.e. the above second network address) after the Host performs the IP hopping.

[0088] 2. Upload the IP hopping request and transfer end signal to the controller module of the three-layer gateway (that is, after the above-mentioned VxLAN message is transferred to the second network node, the two-layer gateway will send a transfer end signal to the three-layer), and transmit the IP request response of the controller module (that is, the above-mentioned hopping request response).

[0089] 4. Establish a corresponding relationship between IP_B (ie, the second network node mentioned above) and NEW_IP.

[0090] Host (Host1, Host2, Host3) may include a proxy module, which is used to: 1. Monitor and analyze the traffic of the Host.

[0091] 2. Send an IP hopping request and a transfer end signal to the L2 GW (after the VxLAN message is transferred to the Host, i.e. the second network node, a transfer end signal will be sent to the Layer 2 gateway connected to it).

[0092] 3. Generate NEW_IP.

[0093] Above Figure 5 This is merely an example. There may be two or more Layer 2 gateways (i.e., the first Layer 2 gateway 502 and the second Layer 2 gateway 503) connected to the Layer 3 gateway. There may be one or more Hosts connected to the Layer 2 gateway, which is not limited in the present disclosure. Figure 6 It is a functional block diagram illustrating a message forwarding device according to an embodiment of the present disclosure.

[0094] like Figure 6 As shown, Figure 6 Schematic diagram of a message forwarding device 600 according to an embodiment of the present disclosure, comprising a jump request module 601, a jump module 602, a message receiving module 603, a network node determination module 604 and a message forwarding module 605.

[0095] Specifically, the hopping request module 601 is configured to receive a network address hopping request from the first network node.

[0096] Specifically, the jumping module 602 is configured to obtain the second network address of the first network node network after the network address jumps based on the network address jump request with the minimum computing resource load value.

[0097] Specifically, the message receiving module 603 is configured to receive a message whose target network address is the first network address with the minimum computing resource load value, wherein the first network address with the minimum computing resource load value is the network address of the first network node with the minimum computing resource load value before the network address jumps.

[0098] Specifically, the network node determination module 604 is configured to determine a second network node that meets a preset condition.

[0099] Specifically, the message forwarding module 605 is configured to forward the message with the minimum computing resource load value through the second network node with the minimum computing resource load value to the first network node with the minimum computing resource load value whose network address jumps to the second network address with the minimum computing resource load value based on the second network address with the minimum computing resource load value, the second network node and the message with the minimum computing resource load value.

[0100] Further, the jumping module 602 is also configured to: determine the load information of all network nodes connected to the network device with the minimum computing resource load value based on the computing resource load value minimum load information of all network nodes with the minimum computing resource load value; determine whether to perform network address jumping based on the computing resource load value minimum load information of all network nodes with the minimum computing resource load value; and in the case of performing the computing resource load value minimum network address jumping, obtain the computing resource load value minimum second network address of the first network node with the minimum computing resource load value after the computing resource load value minimum network address jump.

[0101] On the other hand, the present disclosure also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the message forwarding methods provided by the above methods.

[0102] On the other hand, the present disclosure further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the message forwarding method provided by the above methods.

[0103] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A message forwarding method, characterized in that: Applied to network equipment, including: receiving a network address hopping request from a first network node; Based on the network address jump request, acquiring a second network address of the first network node after the network address jumps; Receiving a message whose target network address is a first network address, wherein the first network address is a corresponding network address of the first network node before the network address jumps; Determining a second network node that meets a preset condition; Based on the second network address, the second network node and the message, the message is forwarded through the second network node to the first network node whose network address is changed to the second network address.

2. The message forwarding method according to claim 1, characterized in that: The network device includes a layer-3 gateway and at least two layer-2 gateways connected to the layer-3 gateway; The acquiring, based on the network address jump request, the second network address of the first network node after the network address jumps, comprises: The layer-3 gateway determines load information of the at least two layer-2 gateways based on the network address jump request; The layer-3 gateway determines whether to perform network address hopping based on the load information of the at least two layer-2 gateways; When performing the network address jump, the first layer 2 gateway obtains the second network address of the first network node after the network address jump, wherein the first layer 2 gateway is a gateway among the at least two layer 2 gateways, and the first layer 2 gateway is connected to the first network node.

3. The message forwarding method according to claim 2, characterized in that: The determining of the second network node that meets the preset condition includes: Based on the load information of all network nodes connected to the first layer 2 gateway, determining whether there is a set of network nodes whose storage load is less than a storage load threshold; When there is a set of network nodes whose storage load is less than the storage load threshold, based on the set of network nodes, the network node with the smallest computing resource load value is determined as the second network node.

4. The message forwarding method according to claim 2, characterized in that: The determining of the second network node that meets the preset condition further includes: When there is no network node set whose storage load is less than the storage load threshold, determining, based on the load information of the layer 3 gateway, a second layer 2 gateway having the smallest load rate value among the at least two layer 2 gateways; Determine the set of network nodes whose storage load is less than the storage load threshold based on the load information of all network nodes connected to the second layer 2 gateway; Based on the network node set, the network node with the smallest computing resource load value is determined as the second network node.

5. The message forwarding method according to claim 3 or 4, characterized in that: The calculation formula of the computing resource load value is: ICPU+IGPU; The ICPU is the CPU idle rate of the second network node, and the IGPU is the GPU idle rate of the second network node.

6. The message forwarding method according to claim 1, characterized in that: The message is a virtual extended local area network VxLAN message; The forwarding the message to the first network node whose network address is changed to the second network address through the second network node based on the second network address, the second network node and the message includes: Modify the message header of the VxLAN message, add a new field NEW IP field, where the NEW IP field is used to store the second network address to form a new VxLAN message; Determining network identification information of the second network node; Based on the network identification information, sending the new VxLAN message to the second network node; Based on the second network address, the payload carried by the new VxLAN message sent to the second network node is forwarded to the first network node whose network address jumps to the second network address.

7. The message forwarding method according to claim 5, characterized in that: The message header of the VxLAN message is added with a G flag bit and an E flag bit; Among them, when G is 1, it means that the micro-segmentation function is enabled, and when G is 0, it means that the micro-segmentation function is not enabled; When E is 1, it indicates that network address hopping is enabled, and the second network address is stored in the NEW IP field. When E is 0, it indicates that network address hopping is not enabled.

8. A message forwarding device, characterized in that: include: A hopping request module, configured to receive a network address hopping request from a first network node; A jump module, configured to obtain, based on the network address jump request, a second network address of the first network node network after the network address jump; a message receiving module, configured to receive a message whose target network address is the first network address, wherein the first network address is the network address of the first network node before the network address jumps; A network node determination module, configured to determine a second network node that meets a preset condition; The message forwarding module is configured to forward the message through the second network node to the first network node whose network address jumps to the second network address based on the second network address, the second network node and the message.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the message forwarding method according to any one of claims 1 to 7 is implemented.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the message forwarding method according to any one of claims 1 to 7.

Images