Host connection method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a host connection method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: receiving a to-be-transmitted data packet sent by a first host; performing route query on the to-be-transmitted data packet according to a preset transmission key to obtain a subnet connection route of a target subnet corresponding to the to-be-transmitted data packet; wherein the transmission key comprises a corresponding first key when the on-cloud host accesses the under-cloud host, and a corresponding second key when the under-cloud host accesses the on-cloud host; and forwarding the data packet to be transmitted to the second host through the subnet connection route. By adopting the method, the connection between the on-cloud host and the under-cloud host can be well realized.

Description

Technical Field

[0001] The present application relates to the field of communication network technology, and in particular to a host connection method, device, computer equipment, storage medium and program product. Background Art

[0002] With the development of cloud network technology, cloud platforms can now support multi-resource layout, ultra-large-scale cluster scale, and software and hardware collaboration. The core capabilities of resource pools meet the requirements of ultra-large-scale, high-performance, secure and reliable cloud services.

[0003] Layer 2 gateways can use VPN or cloud dedicated lines to achieve interconnection between VPC (Virtual Private Network) on the cloud and IDC (Internet Data Center) off the cloud. However, there are many problems in the process of interconnection between hosts on the cloud and hosts off the cloud. For example, for VPC computing networks on the cloud and cloud hosts, a large number of broadcast message processing will cause Layer 2 network impact, and the redundant flooding domain control logic is not conducive to VPC network maintenance; when the host HA (High Available, High Availability Cluster) on the cloud is deployed in active and standby mode, when active and standby switching occurs, the free address resolution protocol ARP needs to be notified to the cloud off the cloud, and the host off the cloud needs to process and perceive the change of the media access control address MAC of the host on the cloud; when the Layer 2 gateway network forwards, the forwarding capacity of the large Layer 2 network often relies on MAC learning and Layer 2 MAC table lookup forwarding, and the processing of unknown unicast and broadcast messages is easy to cause the flooding of gateway internal message forwarding, causing the Layer 2 gateway itself to fail, etc., that is, the current effect of on-cloud and off-cloud interconnection is not ideal. Summary of the invention

[0004] Based on this, it is necessary to provide a host connection method, device, computer equipment, storage medium and program product to address the above technical problems, which can well realize the connection between the host on the cloud and the host off the cloud.

[0005] In a first aspect, the present application provides a host connection method, the method comprising:

[0006] receiving a data packet to be transmitted sent by a first host;

[0007] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0008] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0009] In one embodiment, forwarding the data packet to be transmitted to the second host according to the subnet connection route includes:

[0010] According to the second host identifier of the second host carried in the data packet to be transmitted, select the second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; determine the subnet connection tunnel information and the next hop information; and forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0011] In one embodiment, it includes:

[0012] If the second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host; an ARP reply data packet feedback from the second host based on the ARP request message is received; wherein the ARP reply data packet carries the ARP table entry corresponding to the second host; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host in at least one ARP table associated with the subnet connection route.

[0013] In one embodiment, forwarding the data packet to be transmitted to the second host according to the subnet connection route includes:

[0014] Determine the data type corresponding to the data packet to be transmitted; and forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0015] In one embodiment, forwarding the data packet to be transmitted to the second host according to the data type and the subnet connection route includes:

[0016] Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if not, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0017] In one embodiment, it includes:

[0018] End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, control the target subnet to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein, the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

[0019] In one embodiment, it includes:

[0020] If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly check and a destination IP anomaly check are performed on the data packet to be transmitted; wherein, the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; if the source IP anomaly check of the data packet to be transmitted is different or the destination IP anomaly check is different, the data packet to be transmitted is discarded.

[0021] In a second aspect, the present application further provides a host connection device, the device comprising:

[0022] A receiving module, used for receiving a data packet to be transmitted sent by the first host;

[0023] A query module is used to perform a route query on the data packet to be transmitted according to a preset transmission key, and obtain a subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0024] The forwarding module is used to forward the data packet to be transmitted to the second host through the subnet connection route.

[0025] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0026] receiving a data packet to be transmitted sent by a first host;

[0027] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0028] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0030] receiving a data packet to be transmitted sent by a first host;

[0031] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0032] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0033] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0034] receiving a data packet to be transmitted sent by a first host;

[0035] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0036] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0037] The host connection method, device, computer equipment, storage medium and program product described above provide a data basis for extracting address information by receiving a data packet to be transmitted sent by the first host; further, a route query is performed on the data packet to be transmitted according to a preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted, which provides a way to determine the forwarding path of the data packet to be transmitted; further, the data to be transmitted can be forwarded to the second host through the subnet connection route. This solution lays the foundation for accurately determining the subnet connection route corresponding to the data packet to be transmitted by introducing a transmission key; furthermore, by introducing a subnet connection route, a data basis is provided for determining the specific forwarding path of the data packet to be transmitted, and finally a precise connection between the host on the cloud and the host under the cloud is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] FIG1 is an application environment diagram of a host connection method provided in an embodiment of the present application;

[0040] FIG2 is a schematic diagram of a host connection process provided in an embodiment of the present application;

[0041] FIG3 is a schematic diagram of a subnet connection routing structure provided in an embodiment of the present application;

[0042] FIG4 is a schematic diagram of a process of forwarding a data packet to be transmitted provided in an embodiment of the present application;

[0043] FIG5 is a schematic diagram of another process of forwarding a data packet to be transmitted provided in an embodiment of the present application;

[0044] FIG6 is a schematic diagram of a process of forwarding a data packet to be transmitted provided in another embodiment of the present application;

[0045] FIG7 is a schematic diagram of a flow chart of an ARP security policy provided in an embodiment of the present application;

[0046] FIG8 is a structural block diagram of a host connection device provided in an embodiment of the present application;

[0047] FIG. 9 is an internal structure diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] The host connection method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. The layer 2 gateway device is a layer 2 gateway device deployed on the cloud, which realizes the traffic interconnection function between the cloud host (the cloud virtual machine managed by the layer 2 gateway device) in the cloud data center and the cloud host (i.e., the physical server) in the cloud data center through multiple tunnels.

[0050] In an exemplary embodiment, as shown in FIG2 , a host connection method is provided, which is described by taking the method applied to the layer 2 gateway in FIG1 as an example, and may include the following steps:

[0051] S201, receiving a data packet to be transmitted sent by a first host.

[0052] Among them, the first host can represent a host that needs to interact with on-cloud and off-cloud traffic, which can be an on-cloud host or an off-cloud host; the data packet to be transmitted can represent a set of data to be sent by the first host, which can include the original data to be transmitted and the header information of the attached data packet (such as the destination Internet Protocol IP address and the destination Media Access Control Address MAC, etc.).

[0053] Exemplarily, the layer 2 gateway may directly receive the data packet to be transmitted sent by the first host through the first host or a device such as a switch.

[0054] S202, performing a route query on the data packet to be transmitted according to a preset transmission key, and obtaining a subnet connection route of the target subnet corresponding to the data packet to be transmitted.

[0055] Among them, the transmission key includes the first key corresponding to when the cloud host accesses the cloud host, and the second key corresponding to when the cloud host accesses the cloud host; the target subnet represents the subnet where the cloud host is located, and the subnet that the Layer 2 gateway is responsible for; the subnet connection route may include but is not limited to the transmission key (or connection identification code ID), the connection subnet IP prefix segment, the Layer 2 gateway instance to which the subnet connection belongs, the Address Resolution Protocol ARP table entry information, the connection tunnel information, the route next hop information, etc.

[0056] It should be noted that the transmission key includes the first key and the second key, that is, the first key corresponding to the access of the host on the cloud to the host off the cloud includes the virtual private network VPC where the host on the cloud is located, the virtual network identifier VNI and the target subnet connection MAC, etc., and the second key corresponding to the access of the host off the cloud to the host on the cloud includes the VPC where the host on the cloud is located, VNI, connection tunnel VNI, connection tunnel cloud endpoint IP (or tunnel local IP) and connection tunnel cloud endpoint IP (or tunnel peer IP), etc.

[0057] Optionally, the ARP table entry information may include proxy MAC, connection IP, ARP proxy flag, ARP learning flag, ARP table entry specification, ARP table index, etc.; among which, the ARP proxy flag can be used to control the opening / closing of the ARP proxy function (by the Layer 2 gateway proxy), the ARP learning flag can be used to control the opening / closing of the ARP learning function (by the Layer 2 gateway proxy), and the ARP proxy flag and ARP learning flag can be used to narrow the fault domain and isolate the fault. The connection tunnel information may include the connection tunnel VNI, the connection tunnel cloud endpoint IP (or tunnel local ip), the connection tunnel cloud endpoint IP (or tunnel peer ip), the connection tunnel port MAC, the connection tunnel gateway MAC, etc. The routing next hop information may include the gateway VNI and next hop IP of the next hop connection tunnel, etc.

[0058] Exemplarily, based on a preset transmission key, the routing table entry corresponding to the transmission key can be searched from the subnet connection routing table of the Layer 2 gateway to determine the subnet connection route of the target subnet corresponding to the data packet to be transmitted. Optionally, the subnet connection routing table is based on a hash table, and the subnet connection routing table entries are stored in the table, as shown in FIG3 .

[0059] S203, forwarding the data packet to be transmitted to the second host through the subnet connection route.

[0060] Exemplarily, the data packet to be transmitted may be re-encapsulated according to the subnet connection route to ensure that the data packet to be transmitted is forwarded to the second host via a correct forwarding path.

[0061] The above host connection method provides a data basis for extracting address information by receiving the data packet to be transmitted sent by the first host; further, a route query is performed on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted, which provides a way to determine the forwarding path of the data packet to be transmitted; further, the data to be transmitted can be forwarded to the second host through the subnet connection route. This solution lays the foundation for accurately determining the subnet connection route corresponding to the data packet to be transmitted by introducing the transmission key; furthermore, by introducing the subnet connection route, it provides a data basis for determining the specific forwarding path of the data packet to be transmitted, and finally realizes the precise connection between the host on the cloud and the host under the cloud.

[0062] On the basis of the above-mentioned embodiments, subnet connection route lookup for bidirectional traffic on and off the cloud is implemented by transmitting keys; the connection is based on the subnet granularity to achieve isolation between subnets; cross-subnet mutual access uses the connection of the corresponding subnet, avoiding the risk of flooding caused by MAC table learning and unknown unicast or broadcast message forwarding in the Layer 2 bridging mode. Furthermore, by maintaining ARP entries, specifications, learning capabilities, etc. at the subnet connection routing granularity, ARP can be controlled at the subnet connection granularity, such as by identifying and filtering abnormal ARP packets under the cloud, implementing ARP security policies and preventing ARP traffic under the cloud from impacting the VPC network and hosts on the cloud, and by turning on or off ARP proxy and learning capabilities within the subnet connection granularity, the fault domain can be reduced and faults can be isolated; and when the ARP proxy of the host under the cloud and the host under the cloud learn the ARP of the host on the cloud at the subnet connection granularity, the second-layer gateway proxy responds to the proxy MAC under the subnet connection, and when the host on the cloud accesses the host under the cloud, the second-layer network proxy initiates the ARP request under the cloud and learns the ARP entry under the cloud, and the host on the cloud does not need to learn the ARP of the host under the cloud, and the host under the cloud does not need to perceive the HA master-slave switching of the host on the cloud. At the same time, the ARP processing of the network within the computing can be reduced, and the risk of broadcast traffic impacting the computing network can be reduced. The embodiment of the present application explains the above embodiment S203 in detail. Specifically, when the first host is a cloud host and the second host is a cloud host, when the cloud host accesses the cloud host, the traffic direction is defined as upstream traffic. The process of forwarding data packets to be transmitted in the embodiment of the present application is shown in FIG4 and specifically includes the following steps:

[0063] S401, selecting a second ARP table entry corresponding to a second host from at least one candidate Address Resolution Protocol ARP table associated with a subnet connection route according to a second host identifier of the second host carried in a data packet to be transmitted.

[0064] Among them, the second host identifier is an identifier that can be used to uniquely identify a network device, such as an IP address; the candidate address resolution protocol ARP table is a table that stores the correspondence between IP addresses and MAC addresses between network devices, which can realize the mapping conversion from IP address to MAC address and realize the correct transmission of data in the network; the second ARP table entry includes the correspondence between the IP address and MAC address of the second host.

[0065] Exemplarily, based on the data packet to be transmitted, the second host identifier of the second host (i.e., the host under the cloud), such as the IP address of the second host (i.e., the host under the cloud), can be determined; further, the ARP table entry corresponding to the IP address of the second host (i.e., the host under the cloud) can be searched from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, and the ARP table entry can be determined as the second ARP table entry corresponding to the second host (i.e., the host under the cloud).

[0066] It should be noted that if the second ARP table entry corresponding to the second host (i.e., the host under the cloud) is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host (i.e., the host under the cloud); the ARP reply data packet fed back by the second host (i.e., the host under the cloud) based on the ARP request message is received; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host (i.e., the host under the cloud) in at least one ARP table associated with the subnet connection route.

[0067] Among them, an ARP request message is a data packet used to query the MAC address of the target device; an ARP reply data packet is a data packet sent by the target device in response to the query of the requesting device after receiving the ARP request message, that is, the ARP reply data packet includes the MAC address of the target device, that is, the ARP reply data packet in this application carries the ARP table entry corresponding to the second host (i.e., the host under the cloud).

[0068] It should be noted that the ARP learning function refers to the ability of a network device to dynamically establish and maintain ARP table entries by receiving and processing ARP packets; the ARP learning function in the embodiment of the present application can be performed by a Layer 2 gateway proxy cloud host (i.e., the first host) to perform ARP learning; wherein, whether the ARP proxy and ARP learning functions are to be enabled can be set, for example, whether the ARP learning function is enabled can be set through the ARP learning flag, such as the ARP learning flag = "1", which means that the ARP learning function is enabled, and the ARP learning flag = "0", which means that the ARP learning function is disabled; correspondingly, whether the Layer 2 gateway proxy cloud host (i.e., the first host) is enabled can be set through the ARP proxy flag, such as the ARP proxy flag = "1", which means that the Layer 2 gateway proxy cloud host (i.e., the first host) is enabled, and the ARP proxy flag = "0", which means that the Layer 2 gateway proxy cloud host (i.e., the first host) is disabled.

[0069] Exemplarily, if the second ARP table entry corresponding to the second host (i.e., the host under the cloud) is not found in at least one candidate address resolution protocol ARP table associated with the subnet connection route, the second-layer gateway can send an ARP request message on behalf of the host on the cloud (i.e., the first host); further, after receiving the ARP request message, the second host (i.e., the host under the cloud) will check whether the destination IP address in the ARP request message is the same as its own IP address. If they are the same, the second host (i.e., the host under the cloud) knows that this is a query for itself; further, the second host (i.e., the host under the cloud) will respond to the ARP request message by feeding back an ARP reply data packet (including the MAC address and IP address of the second host), and further, the ARP learning function is triggered by the ARP learning flag to record the MAC address and IP address of the second host (i.e., the host under the cloud), that is, the target subnet records the ARP table entry corresponding to the second host (i.e., the host under the cloud) in at least one ARP table associated with the subnet connection route.

[0070] S402, determine the subnet connection tunnel information and next hop information.

[0071] Exemplarily, the subnet connection tunnel information and the next hop information may be determined based on the subnet connection route of the target subnet corresponding to the data packet to be transmitted.

[0072] S403: forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0073] Exemplarily, the header information of the data packet to be transmitted can be updated based on the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information, and the data packet to be transmitted can be forwarded to the second host according to the updated header information of the data packet to be transmitted.

[0074] In the embodiment of the present application, by introducing subnet connection tunnel information and next hop information, a method is provided for accurately determining the forwarding path of the data packet to be transmitted.

[0075] On the basis of the above-mentioned embodiment, the embodiment of the present application further explains the above-mentioned embodiment S203 in detail. Specifically, when the first host is a cloud host and the second host is a cloud host, when the cloud host accesses the cloud host, the traffic direction is defined as downlink traffic. The process of forwarding the data packet to be transmitted in the embodiment of the present application is shown in FIG5, and specifically includes the following steps:

[0076] S501, determining the data type corresponding to the data packet to be transmitted.

[0077] In addition, the data type may also be expressed as a message type, which may include but is not limited to Internet Protocol IP messages and Internet Protocol ARP messages.

[0078] It should be noted that the structures of Internet Protocol IP messages and Internet Protocol ARP messages are different. Internet Protocol IP messages are mainly used to implement the routing and forwarding of data packets, including version, header length, service type, total length, identification, flag, fragment offset, lifetime, protocol, header checksum, source IP address and destination IP address, etc.; Internet Protocol ARP messages are used to implement IP address to MAC address resolution, including hardware type, protocol type, hardware address length, protocol address length, operation code, sender MAC address, sender IP address, target MAC address and target IP address, etc.

[0079] Optionally, the data type corresponding to the data packet to be transmitted may be determined according to the structure of the data packet to be transmitted.

[0080] S502: forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0081] Exemplarily, as shown in Figure 6, the process of forwarding the data packet to be transmitted based on the subnet connection route can be understood, and the address information can be determined based on the data type; the subnet connection route corresponding to the data packet to be transmitted can be determined based on the hash value (i.e., key2) in the data packet to be transmitted, and then, based on the subnet connection route, the forwarding path can be determined; and then, based on the address information and the forwarding path, the data packet to be transmitted can be forwarded to the destination, i.e., the second host.

[0082] One possible implementation method is, if the data type is an Internet Protocol IP message, verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if they do not match, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0083] Among them, the MAC corresponding to the data packet to be transmitted can be the destination MAC in the data packet to be transmitted, that is, the MAC of the subnet where the cloud host is located; the target subnet can represent the subnet where the cloud host is located, and also represents a subnet that the Layer 2 gateway is responsible for processing.

[0084] Exemplarily, when the data packet to be transmitted is an Internet Protocol IP message, the destination MAC is extracted from the data packet to be transmitted; further, the destination MAC is matched with the MAC of the target subnet. If the match is unsuccessful, it indicates that the data packet to be transmitted may be tampered with, sent incorrectly or have other security issues during transmission, and the data packet to be transmitted is discarded; if the match is successful, it indicates that the data packet to be transmitted is indeed sent to the Layer 2 gateway, and the data packet to be transmitted can be forwarded, that is, the local route within the VPC where the second host is located can be further searched based on the virtual logical network VPC where the second host is located, and the data packet to be transmitted can be forwarded to the second host.

[0085] Another possible implementation method is that if the data type is an Internet Protocol ARP message, the forwarding process of the data packet to be transmitted is terminated, and an ARP reply message is sent to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, the target subnet is controlled to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route.

[0086] Among them, ARP message types include ARP request messages, ARP reply messages and gratuitous ARP messages.

[0087] Exemplarily, the Layer 2 gateway processes Internet Protocol ARP messages on behalf of the cloud host. That is, when the Layer 2 gateway receives a data packet to be transmitted of the Internet Protocol ARP message type, it will end the forwarding process of the data packet to be transmitted (that is, the data packet to be transmitted will not be transmitted to the cloud host), and will learn the ARP information in the data packet to be transmitted, and update at least one ARP table associated with the subnet connection route of the target subnet, and respond to the Internet Protocol ARP message by sending an ARP reply message.

[0088] It should be noted that when the off-cloud host accesses the on-cloud host, it enters the on-cloud VPC network through the dedicated line or VPN network after accessing the virtual tunnel at Layer 2. This may cause the risk of off-cloud host ARP Layer 2 flooding or ARP spoofing to impact the on-cloud VPC network. The ARP security policy can be implemented by identifying and filtering abnormal ARP to deal with the risk of off-cloud ARP message impact. The ARP security policy is shown in Figure 7.

[0089] Optionally, if the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, source IP anomaly detection and destination IP anomaly detection are performed on the data packet to be transmitted; if the source IP anomaly detection or destination IP anomaly detection of the data packet to be transmitted is different, the data packet to be transmitted is discarded.

[0090] Among them, the source IP is the IP address of the first host, that is, the sender IP address; the destination IP is the IP address of the second host, that is, the target IP address.

[0091] For example, ARP packets with abnormal source IP can be identified and filtered. According to the source IP field of the ARP message, the local routing table entry in the VPC is searched. When the routing table entry is hit (that is, the local routing table entry in the VPC contains the same IP address as the source IP in the ARP message), there is a host IP conflict or IP spoofing, and this type of ARP message is discarded. ARP request packets with abnormal destination IP can also be identified and filtered. According to the destination IP field of the ARP message, the local routing table entry in the VPC is searched. When the routing table entry is not hit (that is, the ARP request packet may be searching for the MAC address of another host), there is an ARP flooding or scanning attack, and the message is discarded. Discard this type of ARP message; you can also identify and filter ARP reply packets with abnormal destination IP. The destination IP field of the ARP message is matched with the connection IP of the subnet connection route. Since the Layer 2 gateway uses the connection IP for proxy, if the above does not match, this type of ARP message is discarded; you can also identify and filter free ARP messages (when the host under the cloud performs active-standby switching, the MAC address of the host under the cloud will change. At this time, the host under the cloud will send free ARP messages to other related hosts). When there is no ARP table entry for this message IP field in the ARP table of the Layer 2 gateway subnet connection route, this type of message is discarded and the ARP table entry is not recorded or refreshed.

[0092] In the embodiment of the present application, by analyzing the situation of the host under the cloud accessing the host on the cloud, implementation details are provided for forwarding the data packets to be transmitted.

[0093] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0094] Based on the same inventive concept, the embodiment of the present application also provides a host connection device for implementing the host connection method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more host connection device embodiments provided below can refer to the limitations on the host connection method above, and will not be repeated here.

[0095] In an exemplary embodiment, as shown in FIG8 , a host connection device 1 is provided, comprising: a receiving module 10, a query module 20 and a forwarding module 30, wherein:

[0096] The receiving module 10 is used to receive a data packet to be transmitted sent by the first host;

[0097] The query module 20 is used to perform a route query on the data packet to be transmitted according to a preset transmission key to obtain a subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0098] The forwarding module 30 is used to forward the data packet to be transmitted to the second host through the subnet connection route.

[0099] In one embodiment, the forwarding module 30 is specifically configured to:

[0100] According to the second host identifier of the second host carried in the data packet to be transmitted, select the second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; determine the subnet connection tunnel information and the next hop information; and forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0101] In one embodiment, the forwarding module 30 is further configured to:

[0102] If the second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host; an ARP reply data packet feedback from the second host based on the ARP request message is received; wherein the ARP reply data packet carries the ARP table entry corresponding to the second host; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host in at least one ARP table associated with the subnet connection route.

[0103] In one embodiment, the forwarding module 30 is specifically configured to:

[0104] Determine the data type corresponding to the data packet to be transmitted; and forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0105] In one embodiment, the forwarding module 30 is specifically configured to:

[0106] Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if not, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0107] In one embodiment, the forwarding module 30 is specifically configured to:

[0108] End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, control the target subnet to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein, the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

[0109] In one embodiment, the forwarding module 30 is specifically configured to:

[0110] If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly check and a destination IP anomaly check are performed on the data packet to be transmitted; wherein, the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; if the source IP anomaly check of the data packet to be transmitted is different or the destination IP anomaly check is different, the data packet to be transmitted is discarded.

[0111] Each module in the host connection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0112] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG9. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data with transmission data packets and subnet connection routing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a host connection method is implemented.

[0113] Those skilled in the art will understand that the structure shown in FIG. 9 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0114] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0115] receiving a data packet to be transmitted sent by a first host;

[0116] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0117] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0118] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0119] According to the second host identifier of the second host carried in the data packet to be transmitted, select the second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; determine the subnet connection tunnel information and the next hop information; and forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0120] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0121] If the second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host; an ARP reply data packet feedback from the second host based on the ARP request message is received; wherein the ARP reply data packet carries the ARP table entry corresponding to the second host; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host in at least one ARP table associated with the subnet connection route.

[0122] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0123] Determine the data type corresponding to the data packet to be transmitted; and forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0124] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0125] Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if not, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0126] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0127] End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, control the target subnet to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein, the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

[0128] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0129] If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly check and a destination IP anomaly check are performed on the data packet to be transmitted; wherein, the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; if the source IP anomaly check of the data packet to be transmitted is different or the destination IP anomaly check is different, the data packet to be transmitted is discarded.

[0130] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0131] receiving a data packet to be transmitted sent by a first host;

[0132] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0133] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0134] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0135] According to the second host identifier of the second host carried in the data packet to be transmitted, select the second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; determine the subnet connection tunnel information and the next hop information; and forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0136] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0137] If the second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host; an ARP reply data packet feedback from the second host based on the ARP request message is received; wherein the ARP reply data packet carries the ARP table entry corresponding to the second host; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host in at least one ARP table associated with the subnet connection route.

[0138] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0139] Determine the data type corresponding to the data packet to be transmitted; and forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0140] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0141] Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if not, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0142] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0143] End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, control the target subnet to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein, the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

[0144] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0145] If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly check and a destination IP anomaly check are performed on the data packet to be transmitted; wherein, the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; if the source IP anomaly check of the data packet to be transmitted is different or the destination IP anomaly check is different, the data packet to be transmitted is discarded.

[0146] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0147] receiving a data packet to be transmitted sent by a first host;

[0148] Perform route query on the data packet to be transmitted according to the preset transmission key to obtain the subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host;

[0149] The data packet to be transmitted is forwarded to the second host through the subnet connection route.

[0150] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0151] According to the second host identifier of the second host carried in the data packet to be transmitted, select the second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; determine the subnet connection tunnel information and the next hop information; and forward the data packet to be transmitted to the second host according to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information.

[0152] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0153] If the second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, the ARP request message is forwarded to the second host; an ARP reply data packet feedback from the second host based on the ARP request message is received; wherein the ARP reply data packet carries the ARP table entry corresponding to the second host; and the target subnet is controlled to trigger the ARP learning function so that the target subnet records the ARP table entry corresponding to the second host in at least one ARP table associated with the subnet connection route.

[0154] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0155] Determine the data type corresponding to the data packet to be transmitted; and forward the data packet to be transmitted to the second host according to the data type and the subnet connection route.

[0156] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0157] Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; if not, discard the data packet to be transmitted; if they match, forward the data packet to be transmitted to the second host based on the virtual logical network VPC where the second host is located.

[0158] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0159] End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; according to the ARP message type corresponding to the data packet to be transmitted sent by the first host, control the target subnet to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein, the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

[0160] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0161] If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly check and a destination IP anomaly check are performed on the data packet to be transmitted; wherein, the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; if the source IP anomaly check of the data packet to be transmitted is different or the destination IP anomaly check is different, the data packet to be transmitted is discarded.

[0162] It should be noted that the information (including but not limited to device information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0163] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0164] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0165] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A host connection method, characterized in that: The method comprises: receiving a data packet to be transmitted sent by a first host; Performing a route query on the data packet to be transmitted according to a preset transmission key to obtain a subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host; The data packet to be transmitted is forwarded to the second host through the subnet connection route.

2. The method according to claim 1, characterized in that If the first host is a cloud host, the second host is an off-cloud host; Correspondingly, forwarding the data packet to be transmitted to the second host according to the subnet connection route includes: According to the second host identifier of the second host carried in the data packet to be transmitted, selecting a second ARP table entry corresponding to the second host from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route; Determine the subnet connection tunnel information and next hop information; According to the second ARP table entry, the media access control address MAC of the target subnet, the subnet connection tunnel information and the next hop information, the data packet to be transmitted is forwarded to the second host.

3. The method according to claim 2, characterized in that The method further comprises: If a second ARP table entry corresponding to the second host is not determined from at least one candidate Address Resolution Protocol ARP table associated with the subnet connection route, forwarding the ARP request message to the second host; Receiving an ARP reply data packet fed back by the second host based on the ARP request message; wherein the ARP reply data packet carries an ARP table entry corresponding to the second host; The target subnet is controlled to trigger an ARP learning function so that the target subnet records an ARP table entry corresponding to the second host in at least one ARP table associated with a subnet connection route.

4. The method according to claim 1, characterized in that: If the first host is an off-cloud host, the second host is an on-cloud host; Correspondingly, forwarding the data packet to be transmitted to the second host according to the subnet connection route includes: Determine the data type corresponding to the data packet to be transmitted; According to the data type and the subnet connection route, the data packet to be transmitted is forwarded to the second host.

5. The method according to claim 4, characterized in that If the data type is an Internet Protocol IP message; Correspondingly, forwarding the data packet to be transmitted to the second host according to the data type and the subnet connection route includes: Verify whether the MAC corresponding to the data packet to be transmitted matches the MAC of the target subnet; If there is no match, the data packet to be transmitted is discarded; If there is a match, the data packet to be transmitted is forwarded to the second host based on the virtual logical network VPC where the second host is located.

6. The method according to claim 5, characterized in that If the data type is an Internet Protocol ARP message; the method further includes: End the forwarding process of the data packet to be transmitted, and send an ARP reply message to the first host through the MAC of the target subnet; According to the ARP message type corresponding to the data packet to be transmitted sent by the first host, the target subnet is controlled to trigger the ARP learning function, so that the target subnet records or updates the ARP table entry corresponding to the first host in at least one ARP table associated with the subnet connection route; wherein the ARP message types include ARP request messages, ARP reply messages and free ARP messages.

7. The method according to claim 6, characterized in that The method further comprises: If the data type corresponding to the data packet to be transmitted is an Internet Protocol ARP message, a source IP anomaly detection and a destination IP anomaly detection are performed on the data packet to be transmitted; wherein the source IP is the IP address of the first host, and the destination IP is the IP address of the second host; In case the source IP anomaly detection of the data packet to be transmitted is different or the destination IP anomaly detection is different, the data packet to be transmitted is discarded.

8. A host connection device, characterized in that: The device comprises: A receiving module, used for receiving a data packet to be transmitted sent by the first host; A query module, used to perform a route query on the data packet to be transmitted according to a preset transmission key, and obtain a subnet connection route of the target subnet corresponding to the data packet to be transmitted; wherein the transmission key includes a first key corresponding to when the cloud host accesses the cloud host, and a second key corresponding to when the cloud host accesses the cloud host; The forwarding module is used to forward the data packet to be transmitted to the second host through the subnet connection route.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images