Message forwarding method and device, storage medium and computer program product

Abstract

The present disclosure relates to the technical field of network security, and particularly relates to a message forwarding method and device, a storage medium and a computer program product. The forwarding method is applied to a network device and comprises the following steps: receiving a network address hopping request from a first network node; obtaining a second network address of the first network node after network address hopping based on the network address hopping request; receiving a message with a target network address being a first network address of the first network node, wherein the first network address is a corresponding network address of the first network node before network address hopping; determining a second network node satisfying a preset condition; and forwarding the message to the first network node with the network address being changed to the second network address through the second network node based on the second network address, the second network node and the message. The present disclosure changes the network address of the network node dynamically, and selects a suitable storage node to send the message to the first network node after network address hopping, thereby effectively defending against APT attacks.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of network security, and in particular, to a message forwarding method and device, a storage medium and a computer program product. BACKGROUND

[0002] An advanced persistent threat (APT) refers to a sustained and effective attack activity launched by an organization against a specific object, and has the characteristics of high concealment and strong targeting.

[0003] In the process of message forwarding, although the use of traditional defense means such as antivirus software, firewalls, and intrusion detection can improve the network defense capability, it cannot effectively resist APT attacks. SUMMARY

[0004] The present disclosure is proposed in view of the above problems. The present disclosure provides a message forwarding method and device, a storage medium and a computer program product.

[0005] According to one aspect of the present disclosure, the present disclosure provides a message forwarding method applied to a network device, comprising: receiving a network address hopping request from a first network node; obtaining a second network address of the first network node after network address hopping based on the network address hopping request; receiving a message with a target network address being a first network address of the first network node, wherein the first network address is a corresponding network address of the first network node before network address hopping; determining a second network node satisfying a preset condition; and forwarding the message to the first network node with the network address hopping to the second network address through the second network node based on the second network address, the second network node, and the message.

[0006] In addition, according to the message forwarding method of one aspect of the present disclosure, the network device comprises a three-layer gateway and at least two two-layer gateways connected to the three-layer gateway; obtaining the second network address of the first network node after network address hopping based on the network address hopping request comprises: the three-layer gateway determines load information of the at least two two-layer gateways based on the network address hopping request; the three-layer gateway determines whether to perform network address hopping based on the load information of the at least two two-layer gateways; and in the case of performing network address hopping, the first two-layer gateway obtains the second network address of the first network node after network address hopping, wherein the first two-layer gateway is a gateway in the at least two two-layer gateways, and the first two-layer gateway is connected to the first network node.

[0007] Further, the packet forwarding method according to one aspect of the present disclosure, determining the second network node satisfying the preset condition comprises: determining whether there is a network node set with a storage load less than a storage load threshold based on load information of all network nodes connected with the first L2GW; and determining the network node with the minimum computing resource load value as the second network node based on the network node set when there is the network node set with the storage load less than the storage load threshold.

[0008] Further, the packet forwarding method according to one aspect of the present disclosure, determining the second network node satisfying the preset condition further comprises: determining the second L2GW with the minimum load rate value among the at least two L2GWs based on load information of the L3GW when there is no network node set with the storage load less than the storage load threshold; determining the network node set with the storage load less than the storage load threshold based on load information of all network nodes connected with the second L2GW; and determining the network node with the minimum computing resource load value as the second network node based on the network node set.

[0009] Further, the packet forwarding method according to one aspect of the present disclosure, the computing resource load value is calculated according to the formula: ICPU+IGPU; wherein ICPU is the CPU idle rate of the second network node, and IGPU is the GPU idle rate of the second network node.

[0010] Further, the packet forwarding method according to one aspect of the present disclosure, the packet header of the VxLAN packet is added with a G flag bit and an E flag bit; wherein G is 1, indicating that the micro-segmentation function is enabled, G is 0, indicating that the micro-segmentation function is not enabled; E is 1, indicating that the network address hopping is enabled, and the second network address is stored in the NEW IP field, E is 0, indicating that the network address hopping is not enabled.

[0011] Further, the packet forwarding method according to one aspect of the present disclosure, the packet is a virtual extended local area network (VxLAN) packet; and the packet is forwarded to the first network node with the network address hopping to the second network address through the second network node based on the second network address, the second network node and the packet, comprising: modifying the packet header of the VxLAN packet to add a new field NEW IP field, the NEW IP field is used to store the second network address to form a new VxLAN packet; determining network identification information of the second network node; sending the new VxLAN packet to the second network node based on the network identification information; and forwarding the payload carried by the new VxLAN packet sent to the second network node to the first network node with the network address hopping to the second network address based on the second network address.

[0012] Further, the packet forwarding method according to one aspect of the present disclosure, the load information comprises a storage load, a CPU idle rate, a GPU idle rate and a storage threshold.

[0013] According to another aspect of the present disclosure, a packet forwarding apparatus is provided, comprising: a jump request module configured to receive a network address jump request from a first network node; a jump module configured to obtain a second network address of the first network node after network address jump based on the network address jump request; a packet receiving module configured to receive a packet with a target network address being a first network address of the first network node before network address jump; a network node determining module configured to determine a second network node satisfying a preset condition; and a packet forwarding module configured to forward the packet to the first network node with the network address jumped to the second network address through the second network node based on the second network address, the second network node and the packet.

[0014] In addition, according to the network address jump apparatus of another aspect of the present disclosure, the jump module is further configured to: determine load information of all network nodes connected with the network device based on the network address jump request; determine whether to perform network address jump based on the load information of all network nodes; and obtain the second network address of the first network node after network address jump in the case of performing network address jump.

[0015] According to yet another aspect of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the packet forwarding method as described above when executing the computer program.

[0016] According to yet another aspect of the present disclosure, a non-transitory computer readable storage medium is provided, having a computer program stored thereon, wherein the computer program is executable by a processor to implement the packet forwarding method as described above.

[0017] According to yet another aspect of the present disclosure, a computer program product is provided, comprising a computer program executable by a processor to implement the packet forwarding method as described above.

[0018] The packet forwarding method, apparatus, storage medium and computer program product according to embodiments of the present disclosure will be described in detail as follows. The present disclosure dynamically changes the network address of the network node, and selects a suitable forwarding node (second network node) to send the packet to the first network node after network address jump, which increases the difficulty of identifying and attacking the target for the attacker while ensuring the communication quality, thereby effectively defending against APT attacks. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative effort based on these drawings.

[0020] Figure 1 is a flowchart illustrating a packet forwarding method according to an embodiment of the present disclosure.

[0021] Figure 2 is a flowchart further illustrating a packet forwarding method according to an embodiment of the present disclosure.

[0022] Figure 3 is a schematic diagram illustrating the format of a prior VxLAN packet.

[0023] Figure 4 is a schematic diagram illustrating the VxLAN header of a modified VxLAN packet.

[0024] Figure 5 is a schematic diagram illustrating a communication system architecture applying the packet forwarding method according to an embodiment of the present disclosure.

[0025] Figure 6 is a functional block diagram of a network address hopping device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] For the purpose, technical solutions and advantages of the present disclosure to be more clear, the following will combine the drawings in the present disclosure to clearly and completely describe the technical solutions in the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative effort belong to the scope of protection of the present disclosure.

[0027] Figure 1 is a flowchart illustrating a packet forwarding method according to an embodiment of the present disclosure.

[0028] As shown in Figure 1 , the packet forwarding method according to an embodiment of the present disclosure is executed by a network device, and specifically includes the following steps.

[0029] The network device generally refers to a hardware or software entity performing data transmission, forwarding, processing or other network functions in a network. These devices can include routers, switches, firewalls, load balancers, servers, etc. Responsible for transmitting messages in the network, and routing, forwarding or processing messages according to network protocols and policies. In the method of the embodiments of the present disclosure, the network device can include a Layer 3 Gateway (L3 GW) and at least two Layer 2 Gateways (L2 GWs) connected to the Layer 3 Gateway, which are responsible for receiving network address hopping requests, performing address hopping operations, and forwarding messages.

[0030] Step S101, receiving a network address hopping request from a first network node.

[0031] In an embodiment of the present disclosure, the first network node refers to any device with network functions, such as a computer, a server, a router, a switch, etc. The first network node monitors its own traffic and analyzes when it detects a sudden surge in traffic on a certain port, far exceeding the normal level at all times; or detect non-standard or unknown protocol traffic, which means that a hacker may be trying to exploit unknown vulnerabilities or conduct malicious scanning. At this time, the first network device node will send a network address hopping request to the network device.

[0032] In an embodiment of the present disclosure, the first network node can also send a network address hopping request to the L2 GW connected thereto, and the L2 GW will upload the network address hopping request to the L3 GW after receiving the network address hopping request.

[0033] Step S102, obtaining a second network address of the first network node after network address hopping based on the network address hopping request.

[0034] In an embodiment of the present disclosure, the second network address refers to the new network address used for communication in the network after the network address hopping of the first network node. After receiving the network address hopping request, the network device will send a hopping request response to the first network node to inform the first network node that its network address hopping request has been accepted, if the hopping is allowed. After receiving the hopping request response, the first network node will hop the original network address of the first network node to the second network address, and send the second network address to the network device, so that the network device obtains the new network address of the first network node after network address hopping, i.e. the second network address.

[0035] In one embodiment of the present disclosure, the first network node sends a network address hopping request to the L2 GW connected thereto, the L2 GW uploads the network address hopping request to the L3 GW upon receiving the network address hopping request, the L3 GW informs the L2 GW connected to the first network node to allow the network address hopping upon determining to allow the hopping in the case, and the L2 GW sends a hopping request response to the first network node, informing the first network node that the network address hopping request has been accepted. The first network node hops the original network address of the first network node to a second network address upon receiving the hopping request response, and sends the second network address to the L2 GW, so that the L2 GW obtains the new network address of the first network node after the network address hopping, i.e. the second network address.

[0036] Exemplarily, it is assumed that the first network node initiates a network address hopping request at t1, and the original IP (i.e. the original network address) is defined as OLD_IP. If the first network node receives the IP hopping request response, the IP address hopping process is started. It is assumed that the first network node receives the hopping request response at t2, first obtains the UNIX timestamp at t2, and then generates a 32-byte result through the following formula (2), and takes the first 2 bytes (16 bits) as NEW_IP (i.e. the second network address). The NEW_IP is uploaded to the L2 GW for storage.

[0037] In the formula (2), the formula (2) is:

[0038] .

[0039] Step S103, receiving a packet with a target network address being a first network address, wherein the first network address is a network address of the first network node before the network address hopping.

[0040] In one embodiment of the present disclosure, the target network address refers to the destination address of the packet in the transmission process. The first network address is a network address used for communication in the network before the first network node performs the network address hopping. The first network node has performed the network address hopping operation, and its network address has changed. However, although the address of the first network node has changed, there may still be packets sent to its old address (i.e. the first network address). These packets are received by the network device in step S103.

[0041] Step S104, determining a second network node satisfying a preset condition.

[0042] In one embodiment of the present disclosure, the preset condition refers to a set of rules or standards set in advance in a specific case, and the second network node refers to any device with network function, such as a computer, a server, a router, a switch, etc. After receiving the packet with the target network address being the first network address, the network device will find the second network node satisfying the preset condition according to the preset condition.

[0043] In one embodiment of the present disclosure, the second network node satisfying the preset condition is determined by the two-layer gateway connected to the first network node.

[0044] In step S105, the packet is forwarded to the first network node with the network address changed to the second network address through the second network node based on the second network address, the second network node and the packet.

[0045] In one embodiment of the present disclosure, the network device will forward the packet to the first network node with the network address changed to the second network address through the found second network node according to the second network address, the second network node and the received packet with the target network address being the first network address, i.e. the first network node after the network address change.

[0046] In summary, according to the technical scheme provided by the embodiment of the present disclosure, the network address of the network node is dynamically changed, and the packet is sent to the first network node with the network address changed through the selected storage node (second network node), which increases the difficulty of identifying and attacking the target of the attacker while ensuring the communication quality, thereby effectively defending against APT attack.

[0047] Further, the network device comprises a three-layer gateway and at least two two-layer gateways connected to the three-layer gateway, and the second network address of the first network node after the network address change is obtained based on the network address change request, comprising: the three-layer gateway determines the load information of the at least two two-layer gateways based on the network address change request; the three-layer gateway determines whether to perform network address change based on the load information of the at least two two-layer gateways; in the case of performing network address change, the first two-layer gateway obtains the second network address of the first network node after the network address change, wherein the first two-layer gateway is a gateway in the at least two two-layer gateways, and the first two-layer gateway is connected to the first network node.

[0048] Specifically, after receiving the network address hopping request, the L3GW first determines the load information of all L2GWs connected to the L3GW, determines the current network state through the load information of the L2GWs, and determines whether to perform network address hopping according to the current network state. For example, through the load information, it is determined that the current network state is defined as busy, and hopping is prohibited, and vice versa. In the case of determining to allow hopping, the L3GW informs the first L2GW connected to the first network node to allow the network address hopping to be performed. Further, the first L2GW sends a hopping request response to the first network node, informing the first network node that its network address hopping request has been accepted. After receiving the hopping request response, the first network node hops the original network address of the first network node to a second network address, and sends the second network address to the network device, so that the network device obtains the new network address of the first network node after network address hopping, i.e., the second network address.

[0049] In an embodiment of the present disclosure, the L3GW and the L2GWs connected to the L3GW each have a load information table for subsequent load information measurement. The network node refers to any device with network function, such as a server, a router, a switch, etc. The load information of the network node can include storage load, storage threshold, CPU idle rate, and GPU idle rate.

[0050] The format of the L2GW and L3GW load information tables is shown in Table 1 and Table 2, respectively.

[0051] Table 1: L2GW load information table

[0052]

[0053] Table 2: L3GW load information table

[0054]

[0055] In the load information table of the L2GW, the storage load represents the storage pressure of the network node, and the higher the value, the heavier the load, which is a static indicator. The CPU idle rate is represented by ICPU, and the value is between 0 and 1, 0 represents complete busy, and 1 represents complete idle, which is a dynamic indicator. The GPU idle rate is represented by IGPU, and the value is also between 0 and 1, 0 represents complete busy, and 1 represents complete idle, which is a dynamic indicator. The storage load threshold of the network node is set according to the actual application scenario.

[0056] Exemplarily, VM1_IP and VM2_IP represent the IP addresses of network nodes connected to the L2GW, and L2GW1_IP and L2GW2_IP represent the IP addresses of L2GWs connected to the L3GW.

[0057] Wherein there can be multiple network nodes connected to the L2GW, and there can be multiple L2GWs connected to the L3GW, which are not limited by the present disclosure.

[0058] In the load information table of the L3GW, the load rate L3_Load_Rate represents the load pressure of the L3GW, and the greater the value, the greater the pressure. The calculation formula is:

[0059] (Formula 1)

[0060] The above formula indicates that the L3GW load rate is the sum of the load conditions of all L2GWs it contains. The formula assigns different weights to storage load, CPU busy rate and GPU busy rate, which can be adjusted according to specific application scenarios. Assuming the weights are , and respectively, .

[0061] Exemplarily, after the L3GW receives the network address hopping request, it queries the load information table stored on it. If the proportion of L2GWs whose load rate exceeds the load threshold is more than half, the current network state is defined as busy, and hopping is prohibited; otherwise, hopping is allowed. In the prohibited hopping state, the L2GW does not respond to the hopping request from the first network node; when hopping is allowed, the L2GW responds to the network address hopping request from the first network node through the hopping request.

[0062] In summary, according to the technical scheme provided by the embodiments of the present disclosure, the present disclosure can realize more refined network address hopping management by evaluating the load information of network nodes, ensuring that the hopping operation is performed at the most appropriate time. Avoiding performing address hopping when the network load is high, thereby reducing the impact on network performance and optimizing resource usage. Performing hopping when the network load is low can reduce interference to existing network services and applications, improving the stability of the network. And by performing address hopping when the load is low, the security of the network can be enhanced without affecting user experience. Further, dynamically adjusting the execution of address hopping according to real-time network conditions enables the network to flexibly respond to various security threats.

[0063] Further, the second network node satisfying the preset condition is determined, including: based on the load information of all network nodes connected with the first L2 gateway, determining whether there is a network node set with storage load less than a storage load threshold; when there is a network node set with storage load less than the storage load threshold, based on the network node set, determining the network node with the minimum computing resource load value as the second network node.

[0064] Specifically, when the first L2 gateway receives a packet with the target network address being the first network address, the first L2 gateway queries the load information of all network nodes connected with the first L2 gateway through the load information table of the first L2 gateway, and determines whether there is a network node set with storage load less than a storage load threshold based on the load information of the network nodes. The network node set includes at least one network node. When there is a network node set with storage load less than the storage load threshold, the network node with the minimum computing resource load value is selected from the network node set as the second network node.

[0065] Further, when there is no network node set with storage load less than the storage load threshold, based on the load information of the third L2 gateway, the second L2 gateway with the minimum load rate value in the at least two L2 gateways is determined; based on the load information of all network nodes connected with the second L2 gateway, the network node set with storage load less than the storage load threshold is determined; based on the network node set, the network node with the minimum computing resource load value is determined as the second network node.

[0066] Specifically, when the first L2 gateway connected with the first network node has no network node set with storage load less than the storage load threshold, the first L2 gateway notifies the third L2 gateway to query the load information table thereof. The third L2 gateway finds the second L2 gateway with the minimum load rate value in other L2 gateways connected therewith according to the load information table thereof, and the second L2 gateway is the second L2 gateway. Further, the second L2 gateway queries the load information table thereof to find the network node set with storage load less than the storage load threshold. The network node set includes at least one network node. When there is a network node set with storage load less than the storage load threshold, the network node with the minimum computing resource load value is selected from the network node set as the second network node, and the second L2 gateway informs the first L2 gateway. Further, the first L2 gateway determines the second network node.

[0067] Exemplarily, the computing resource load value can be selected by the load information table to select a network node set with a storage load lower than a storage load threshold value, and then select a network node with the minimum ICPU+IGPU from the network node set as the second network node. Wherein, ICPU is the CPU idle rate of the second network node, and IGPU is the GPU idle rate of the second network node. When selecting the second network node, both the CPU idle rate and the GPU idle rate are considered. Selecting the network node with the minimum sum of the two resources means selecting the network node with the lowest overall computing resource load to ensure that the subsequent forwarding operation is performed on the network node with the least resource tension, thereby minimizing the impact on the performance of the network node and improving the overall resource utilization efficiency.

[0068] In summary, according to the technical scheme provided by the embodiment of the present disclosure, by selecting the network node with the minimum computing resource load value as the second network node, the balanced distribution of network load can be achieved, and the overload of some nodes and the idle of other nodes can be avoided. Further, by selecting the node with the highest idle rate for network address hopping, the network resources can be more effectively utilized, and the overall network operation efficiency can be improved. Further, by preferentially selecting the node with high CPU and GPU idle rates, the impact on the network performance can be reduced, because these nodes are more likely to handle additional network traffic or tasks.

[0069] Figure 2 is a flowchart illustrating a packet forwarding method according to an embodiment of the present disclosure.

[0070] As shown in Figure 2 , according to the packet forwarding method of the embodiment of the present disclosure, based on the second network address, the second network node and the packet, the packet is forwarded to the first network node with the network address hopping to the second network address through the second network node, which specifically includes the following steps.

[0071] In step S201, the packet header of the VxLAN packet is modified, and a new field NEW IP field is added, the NEW IP field is used to store the second network address, and a new VxLAN packet is formed.

[0072] In an embodiment of the present disclosure, the current industry specification for the format of the VxLAN packet is as shown in FIG. 3, Figure 3 is the format of the existing VxLAN packet, the packet header of the VxLAN packet is modified in the present disclosure, a new field NEW IP field is added in the VxLAN header part, and the second network address is stored by using the NEW IP field to generate a new VxLAN packet.

[0073] In an embodiment of the present disclosure, the VxLAN header of the VxLAN packet can also be modified as follows, which can be specifically referred to Figure 4 ,Figure 4 is a VxLAN header diagram illustrating the modified VxLAN packet:

[0074] 1. Add a flag bit G, G is 0 by default, when the G flag bit is set to 1, it means that the micro-segmentation function is enabled, and fine-grained access control is performed. Micro-segmentation is a network security technology that allows smaller logical segments to be created within the network to improve security and isolation. If the micro-segmentation function is enabled (G = 1), the EPG group number to which the sender of the data packet (i.e. the packet) belongs is saved in the subsequent EPG field of the VXLAN packet header. The EPG field is used to identify which terminal group the sender of the data packet belongs to. If the micro-segmentation function is not enabled (G = 0), the EPG field is all 0 by default, indicating that no micro-segmentation information is used. The above modification allows the VxLAN packet to carry additional security and isolation information when transmitting in the network, so that the network device can perform more fine-grained control on the data packet according to this information.

[0075] 2. Add a flag bit E, the default value of E flag bit is 0, which means that the function is disabled without explicit enablement. When the E flag bit is set to 1, it means that the hop function is enabled. The hop function allows the target network address (such as IP address) of the data packet to be dynamically changed in the network to achieve load balancing, failover or other network optimization purposes. If the hop function is enabled (E = 1), the new network address (i.e. the second network address) after the hop is saved in the subsequent 16-bit NEW IP field of the VXLAN packet header. The NEW IP field is used to store the new target network address of the data packet, which can flexibly adapt to the needs of network security and traffic management. If the hop function is not enabled (E = 0), the NEW IP field is all 0 by default, indicating that no network address hopping is performed. In order to balance security and routing efficiency, only the last 16 bits of the network address are hopped. This means that the prefix of the network address remains unchanged, and only the suffix changes. This method can reduce the impact on the routing table to some extent, while providing flexibility in network address. The above modification allows the VxLAN packet to carry the hopped IP address information when transmitting in the network, so that the network device can re-route the data packet according to this information.

[0076] In step S202, the network identification information of the second network node is determined.

[0077] In an embodiment of the present disclosure, the network identification information refers to information used to identify and locate the second network node, including but not limited to IP address, MAC address, VxLAN network identifier, etc. After the second network node is determined, the network identification information of the second network node can be determined according to the determined second network node.

[0078] In step S203, the new VxLAN packet is sent to the second network node based on the network identification information.

[0079] In one embodiment of the present disclosure, the network identification information of the second network node is utilized, which includes but is not limited to IP address, MAC address and VxLAN network identifier. Exemplarily, the new VxLAN packet can be sent to the second network node by determining the optimal path according to one or more of the IP address, MAC address and VxLAN network identifier of the second network node through a routing protocol. During the transmission of the new VxLAN packet, the network identification information ensures that the new VxLAN packet can be correctly identified and routed to the second network node.

[0080] In another embodiment of the present disclosure, according to the network identification information of the second network node, the Inner IP DA (first network address) in the new VxLAN packet with the target network address Inner IP DA as Old_IP (first network address) is changed to IP_B (i.e. the IP address of the second network node), the inner destination MAC address is changed to the MAC address of the second network node, the new VxLAN packet is sent to the second network node by determining the optimal path through a routing protocol. The G and E flag bits in the packet header of the new VxLAN packet can also be set to 0, and the NEW IP field is set to NEW_IP (i.e. the second network address). Here, setting the G and E flag bits to 0 ensures that the micro-segmentation and hop function will not be enabled during packet forwarding, thereby ensuring that the packet can be correctly processed and forwarded according to the new network address and the corresponding relationship.

[0081] In step S204, the payload carried by the new VxLAN packet sent to the second network node is forwarded to the first network node whose network address is changed to the second network address based on the second network address.

[0082] In the embodiment of the present disclosure, after the network address is changed, the network address of the first network node has been changed to the second network address. Therefore, when the new VxLAN packet arrives at the second network node, the payload of the new VxLAN packet needs to be forwarded to the updated address, i.e. the first network node after the network address is changed. After the second network node receives the new VxLAN packet, the payload of the new VxLAN packet is forwarded to the updated address, i.e. the first network node after the network address is changed, by determining the optimal path through a routing protocol and a routing table using the second network address.

[0083] According to the routing requirements of the VxLAN+micro-segmentation network, the second network address is used to determine the optimal path, and the payload of the new VxLAN packet is forwarded to the updated address, i.e., the first network node after the network address hopping, to ensure the continuity and security of network communication.

[0084] In yet another embodiment of the present disclosure, a correspondence between the IP address of the second network node and the second network address is established. After the second network node receives the new VxLAN packet, the new VxLAN packet is completed on the second network node. At this time, the second network node will upload the signal of the end of the storage to the L2 GW, and then the L2 GW and the L3 GW will update the load information table and the flow table. Further, the L2 GW also updates the MAC address table, multicast GBP policy, and EPG grouping table stored thereon. According to the correspondence between the IP address of the second network node and the NEW_IP (i.e., the second network address), the second network node re-encapsulates the new VxLAN packet according to the routing rules of the VxLAN+micro-segmentation network, and forwards the payload of the new VxLAN packet to the updated address, i.e., the first network node after the network address hopping. The above process ensures that the packet can be correctly forwarded to the new destination even in the case of network address hopping. This mechanism can improve the flexibility and security of the network, especially when the network topology needs to be dynamically adjusted or when a network attack needs to be responded to. In this way, the network can dynamically respond to internal or external changes without interrupting services.

[0085] In summary, according to the technical solutions provided by the embodiments of the present disclosure, the present disclosure determines the network identification information of the second network node by modifying the VxLAN packet header and adding the NEW_IP field, sends the new VxLAN packet to the second network node according to the network identification information, and forwards the new VxLAN packet to the first network node after the network address hopping through the second network node. Through the network address hopping, the flexibility and security of the network are improved, and the adaptability and security of the network when facing attacks or topology changes are further improved, while ensuring the continuity of services and the accuracy of communication.

[0086] Figure 5 is a schematic diagram of a communication system architecture illustrating the packet forwarding method provided by the embodiments of the present disclosure.

[0087] As shown in Figure 5 , the communication system 500 includes a three-layer gateway 501, a first two-layer gateway 502 connected to the three-layer gateway, and a second two-layer gateway 503 connected to the three-layer gateway.

[0088] The three-layer gateway 501 can include a controller module for:

[0089] 1. Receiving the IP hop request and the end of conversion signal sent by the IP hop module of the two-layer gateway connected thereto (i.e. after the VxLAN message is converted to the second network node, the two-layer gateway will send the end of conversion signal to the three-layer), and transmitting the IP hop request response downward (i.e. to the two-layer gateway).

[0090] 2. According to the load information of the three-layer gateway, it is judged whether to allow IP hopping.

[0091] The first two-layer gateway 502 and the second two-layer gateway 503 can include a load measurement module and an IP hop module, the first two-layer gateway 502 is connected with Host1 and Host2, and the second two-layer gateway 503 is connected with Host3 (Host1, Host2, Host3 are the network nodes mentioned above).

[0092] Among them, the load measurement module is used for:

[0093] 1. Constructing a load information table according to the information (i.e. the load information of the network node) returned by the agent module of the host (i.e. the network node).

[0094] 2. Querying the load information table to determine the load information of the network node connected with the two-layer network.

[0095] The IP hop module is used for:

[0096] 1. Receiving the IP hop request (i.e. the network address hopping request mentioned above) sent by the host (i.e. the network node), and obtaining the NEW_IP (i.e. the second network address mentioned above) after the host performs IP hopping.

[0097] 2. Uploading the IP hop request and the end of conversion signal (i.e. after the VxLAN message is converted to the second network node, the two-layer gateway will send the end of conversion signal to the three-layer) to the controller module of the three-layer gateway, and downloading the IP request response (i.e. the hop request response mentioned above) of the controller module.

[0098] 4. Establishing the correspondence between IP_B (i.e. the second network node mentioned above) and NEW_IP.

[0099] The host (Host1, Host2, Host3) can include an agent module, which is used for: 1. Monitoring and analyzing the traffic condition of the host.

[0100] 2. Sending the IP hop request and the end of conversion signal (VxLAN message conversion to the host, i.e. the second network node, will send the end of conversion signal to the two-layer gateway connected thereto) to the L2 GW.

[0101] 3. Generating NEW_IP.

[0102] The aboveFigure 5 The two-layer gateway connected with the three-layer gateway is merely exemplary, and can be two (i.e., the first two-layer gateway 502 and the second two-layer gateway 503) or more; the Host connected with the two-layer gateway can be one or more, which is not limited in the disclosure. Figure 6 FIG. 3 is a functional block diagram illustrating a packet forwarding apparatus according to an embodiment of the disclosure.

[0103] As shown in FIG. 4, the packet forwarding apparatus 400 includes a hop request module 401, a hop module 402, a packet receiving module 403, a network node determining module 404, and a packet forwarding module 405. Figure 6 Figure 6 FIG. 5 is a functional block diagram illustrating a packet forwarding apparatus 600 according to an embodiment of the disclosure, including a hop request module 601, a hop module 602, a packet receiving module 603, a network node determining module 604, and a packet forwarding module 605.

[0104] Specifically, the hop request module 601 is configured to receive a network address hop request from a first network node.

[0105] Specifically, the hop module 602 is configured to obtain a second network address of the first network node after network address hopping based on the network address hop request with the minimum computing resource load value.

[0106] Specifically, the packet receiving module 603 is configured to receive a packet with a target network address being a first network address with the minimum computing resource load value, where the first network address with the minimum computing resource load value is a network address of the first network node before network address hopping.

[0107] Specifically, the network node determining module 604 is configured to determine a second network node satisfying a preset condition.

[0108] Specifically, the packet forwarding module 605 is configured to forward the packet with the minimum computing resource load value to the first network node with the minimum computing resource load value, whose network address is hopped to the second network address with the minimum computing resource load value, through the second network node with the minimum computing resource load value, based on the second network address with the minimum computing resource load value, the second network node, and the packet with the minimum computing resource load value.

[0109] Further, the hop module 602 is further configured to: determine load information of all network nodes connected with the network device with the minimum computing resource load value based on the network address hop request with the minimum computing resource load value; determine whether to perform network address hopping based on the load information of all network nodes with the minimum computing resource load value; and obtain a second network address with the minimum computing resource load value of the first network node with the minimum computing resource load value after network address hopping with the minimum computing resource load value in the case of performing network address hopping with the minimum computing resource load value.

[0110] ​In another aspect, the present disclosure also provides a computer program product comprising a computer program, the computer program being stored in a non-transitory computer readable storage medium, and the computer program being capable of performing the packet forwarding method provided by the above-mentioned methods when executed by a processor.

[0111] In yet another aspect, the present disclosure also provides a non-transitory computer readable storage medium having stored thereon a computer program, the computer program being capable of performing the packet forwarding method provided by the above-mentioned methods when executed by a processor.

[0112] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0113] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary general hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of software products, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and include a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0114] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present disclosure, and not to limit them; although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features thereof; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A packet forwarding method, characterized by, Applied to a network device, comprising: receiving a network address hopping request from a first network node; based on the network address hopping request, obtaining the second network address of the first network node after network address hopping; receiving a message whose target network address is the first network address, wherein the first network address is the corresponding network address of the first network node before network address hopping; determining a second network node that meets a preset condition; based on the second network address, the second network node and the message, forwarding the message to the first network node whose network address hops to the second network address through the second network node.

2. The packet forwarding method of claim 1, wherein, The network device comprises a three-layer gateway and at least two two-layer gateways connected to the three-layer gateway; The network device comprises a three-layer gateway and at least two two-layer gateways connected to the three-layer gateway; The three-layer gateway determines the load information of the at least two two-layer gateways based on the network address hopping request; The three-layer gateway determines whether to perform network address hopping based on the load information of the at least two two-layer gateways; In the case of performing the network address hopping, the first two-layer gateway obtains the second network address of the first network node after the network address hopping, wherein the first two-layer gateway is a gateway in the at least two two-layer gateways, and the first two-layer gateway is connected to the first network node.

3. The packet forwarding method of claim 2, wherein, The determination of the second network node that meets the preset condition comprises: based on the load information of all network nodes connected to the first two-layer gateway, determining whether there is a network node set whose storage load is less than a storage load threshold value; When there is a network node set whose storage load is less than a storage load threshold value, based on the network node set, determining the network node with the smallest computing resource load value as the second network node.

4. The packet forwarding method of claim 2, wherein, The determination of the second network node that meets the preset condition further comprises: based on the load information of all network nodes connected to the first two-layer gateway, determining whether there is a network node set whose storage load is less than a storage load threshold value; When there is no network node set whose storage load is less than a storage load threshold value, based on the load information of the three-layer gateway, determining the second two-layer gateway with the smallest load rate value in the at least two two-layer gateways; based on the load information of all network nodes connected to the second two-layer gateway, determining the network node set whose storage load is less than the storage load threshold value; based on the network node set, determining the network node with the smallest computing resource load value as the second network node.

5. The packet forwarding method according to claim 3 or 4, wherein, The formula of the computing resource load value is ICPU+IGPU; Wherein, the ICPU is the CPU idle rate of the second network node, and the IGPU is the GPU idle rate of the second network node.

6. The packet forwarding method of claim 1, wherein, The message is a virtual extended local area network VxLAN message; The forwarding of the message to the first network node whose network address hops to the second network address through the second network node comprises: modify a packet header of the VxLAN packet, add a new field NEW IP field, the NEW IP field is used to store the second network address, form a new VxLAN packet; determine network identification information of the second network node; based on the network identification information, send the new VxLAN packet to the second network node; based on the second network address, forward the payload carried by the new VxLAN packet sent to the second network node to the first network node whose network address is changed to the second network address.

7. The packet forwarding method of claim 6, wherein, The packet header of the VxLAN packet adds a G flag bit and an E flag bit; wherein G is 1, indicating that the micro-segmentation function is enabled, and G is 0, indicating that the micro-segmentation function is not enabled; E is 1, indicating that the network address hopping is enabled, and the second network address is stored in the NEW IP field, and E is 0, indicating that the network address hopping is not enabled.

8. A packet forwarding device, characterized by, comprising: a hopping request module configured to receive a network address hopping request from a first network node; a hopping module configured to obtain a second network address of the first network node after network address hopping based on the network address hopping request; a packet receiving module configured to receive a packet with a target network address being a first network address, wherein the first network address is a network address of the first network node before network address hopping; a network node determining module configured to determine a second network node satisfying a preset condition; a packet forwarding module configured to forward the packet to the first network node whose network address is changed to the second network address through the second network node based on the second network address, the second network node and the packet. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the packet forwarding method of any one of claims 1 to 7.

10. A computer program product, characterised in that, comprising a computer program, the computer program is executed by the processor to realize the packet forwarding method of any one of claims 1 to 7.

Images