Strategy accompanying method and device and electronic equipment

Abstract

The invention discloses a strategy accompanying method, a strategy accompanying device and electronic equipment, and relates to the technical field of communication, the method is applied to a software defined network SDN, the method comprises the following steps: responding to a user operation of selecting a target identification mode, obtaining a first mapping relation and a message of a terminal, and then according to the first mapping relation and the message, identifying the target identification mode according to the first mapping relation and the message; and generating a second mapping relation between the IPv6 address information of the terminal and the user group, and finally, determining a flow strategy of the IPv6 address information according to the second mapping relation. According to the method, the second mapping relation between the IPv6 address information and the user group is generated, and the flow strategy of the IPv6 address information is determined according to the second mapping relation, so that the strategy accompanying of the IPv6 service flow of the terminal is realized.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a strategy accompanying method, device and electronic equipment. Background Art

[0002] In the campus network, network administrators need to uniformly manage users' network access rights and require users to access according to pre-planned network segments and locations. At present, as enterprise networks continue to be built and developed, users' access locations will move over a large range. Network administrators often need to reassign network access rights to users, which brings great inconvenience to network management and maintenance. Therefore, in order to solve the above problems, an effective method for network management and ensuring enterprise network security is proposed, namely, policy mobility. Policy mobility means that no matter where the user moves, the user experience remains unchanged. It breaks the limitation of traditional networks on access locations and truly embodies the characteristic of the network following people.

[0003] Traditional policy mobility solutions are mainly used in Internet Protocol version 4 (IPv4) networks. They achieve policy mobility for terminal IPv4 service traffic by obtaining the relationship between terminal IPv4 address information and user groups and sending the relationship between IPv4 address information and user groups to policy execution nodes. However, with the advent of Internet Protocol version 6 (IPv6), how to achieve policy mobility for terminal IPv6 service traffic has become an urgent problem to be solved. Summary of the invention

[0004] The present application provides a policy following method, device and electronic device, which can implement policy following of terminal IPv6 service traffic.

[0005] In a first aspect, the present application provides a policy accompanying method, the method being applied to a software defined network (SDN), the method comprising:

[0006] In response to a user operation of selecting a target identification mode, obtaining a first mapping relationship and a message of a terminal, wherein the first mapping relationship represents a relationship between MAC address information, IPv4 address information and a user group of the terminal;

[0007] Generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

[0008] Determine a traffic policy for the IPv6 address information according to the second mapping relationship.

[0009] Through the above method, a second mapping relationship between IPv6 address information and user groups is generated, and the traffic policy of IPv6 address information is determined according to the second mapping relationship, so as to realize policy following of terminal IPv6 service traffic.

[0010] In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

[0011] In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0012] In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN;

[0013] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

[0014] Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0015] Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0016] Through the above method, in response to the user operation of selecting the controller identification mode, a second mapping relationship between the IPv6 address information and the user group is generated based on the controller, and the second mapping relationship is sent to the policy execution node, thereby realizing policy-based mobility of the terminal IPv6 service traffic without relying on the authentication device to report the IPv6 address information.

[0017] In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0018] In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN;

[0019] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

[0020] The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0021] The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

[0022] Through the above method, in response to the user operation of selecting the local EVPN identification mode, a second mapping relationship between the IPv6 address information and the user group is generated based on the policy execution node, thereby eliminating the need for the controller to separately send down a traffic policy for the IPv6 address information, thereby improving the performance of policy delivery.

[0023] In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0024] In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN;

[0025] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group comprises:

[0026] The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0027] The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0028] Through the above method, in response to the user operation of selecting the local gateway identification mode, the second mapping relationship between the IPv6 address information and the user group can be directly generated based on the gateway.

[0029] In a second aspect, the present application provides a policy accompanying device, which is applied to a software defined network (SDN), and the device includes:

[0030] An acquisition module, configured to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents a relationship between the MAC address information, the IPv4 address information and the user group of the terminal;

[0031] A generating module, configured to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

[0032] A policy accompanying module is used to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

[0033] In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

[0034] In a possible design, the acquisition module is specifically used for:

[0035] In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN;

[0036] The generation module is specifically used for:

[0037] Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0038] Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0039] In a possible design, the acquisition module is further used for:

[0040] In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN;

[0041] The generation module is also used for:

[0042] The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0043] The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

[0044] In a possible design, the acquisition module is further used for:

[0045] In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN;

[0046] The generation module is also used for:

[0047] The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0048] The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0049] In a third aspect, the present application provides an electronic device, including:

[0050] Memory, used to store computer programs;

[0051] The processor is used to implement the policy following method steps of the first aspect when executing the computer program stored in the memory.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the policy following method steps of the above-mentioned first aspect are implemented.

[0053] Based on the above-mentioned policy following method, a second mapping relationship between IPv6 address information and user groups is generated, and the traffic policy of IPv6 address information is determined according to the second mapping relationship to implement policy following of terminal IPv6 service traffic.

[0054] The technical effects that can be achieved in each of the above-mentioned second to fourth aspects and each of the above-mentioned aspects refer to the technical effects that can be achieved in the above-mentioned first aspect or various possible schemes in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flow chart of a strategy accompanying method provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of signaling interaction of a controller identification mode provided in an embodiment of the present application;

[0057] Figure 3 A signaling interaction diagram of a local EVPN identification mode provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of signaling interaction in a local gateway identification mode provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of the structure of a strategic accompanying device provided in an embodiment of the present application;

[0060] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, and A and B exist, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0062] In order to facilitate understanding by those skilled in the art, the technical terms involved in the embodiments of the present application are first explained.

[0063] (1) Software Defined Network (SDN) is a way to implement network virtualization. It can separate the control plane and data plane of network devices. There is a unified open interface between the control plane and the data plane. The controller is the brain of SDN. It not only provides different levels of programmability to upper-layer network applications through the northbound interface, but also uniformly configures, manages and controls the data plane through the southbound interface.

[0064] (2) Lightweight Directory Access Protocol (LDAP) is a protocol for accessing online directory services. LDAP servers provide global directory services for sharing component information (such as server names and connection properties).

[0065] (3) Office Automation (OA) is a new way of working that combines modern office and computer technology. OA server is a cloud server used to store various OA office software.

[0066] (4) Ethernet Virtual Private Network (EVPN) is a VPN technology used for Layer 2 network interconnection. EVPN extends the BGP protocol to transfer the learning and publishing process of MAC address information between Layer 2 networks from the data plane to the control plane.

[0067] (5) An Autonomous System (AS) is a group of routers managed by the same technical management organization and running the same dynamic routing protocol.

[0068] (6) Border Gateway Protocol (BGP) is a protocol based on AS. BGP neighbor relationship is achieved through manual configuration so that both parties running BGP can find each other and establish a connection.

[0069] (7) Remote Authentic Dial In User Service (RADIUS), used for authentication and billing of dial-up users.

[0070] (8) Address Resolution Protocol (APR) is a protocol that obtains MAC address information based on IP address information.

[0071] (9) The Neighbor Discovery protocol (ND) is mainly responsible for discovering the corresponding address information of other nodes on the link, determining available routes, and maintaining information about available paths and other active nodes. The messages defined by ND include five types:

[0072] Neighbor Solicitation (NS): IPv6 nodes (terminals using the IPv6 protocol) can obtain the link layer address information of neighbors through NS messages and check whether the neighbors are reachable; Neighbor Advertisement (NA): NA messages are the responses of IPv6 nodes to NS messages; Router Solicitation (RS): After the IPv6 node is started, it sends RS messages to the router to request network prefixes and other configuration information for automatic configuration of IPv6 node address information; Router Advertisement (RA): The router periodically publishes RA messages, which include key network configuration information such as network prefixes, or the router responds to RS messages with RA messages; Redirection messages: When the router finds that the incoming interface and outgoing interface of a message are the same, it can use redirection messages to notify the terminal to select another better next hop address information for sending subsequent messages.

[0073] (10) Network Configuration Protocol (NETCONF) is a network management protocol based on Extensible Markup Language. It provides a programmable method for the controller to configure and manage the gateway and obtain the gateway's data.

[0074] (11) Remote Procedure Call Protocol (RPC) is a protocol that requests services from a remote computer program over the network without having to understand the underlying network technology. That is, the controller can remotely call the gateway's data through RPC. GRPC refers to the RPC framework developed by Google.

[0075] (12) Telemetry technology is a comprehensive technology that uses sensor technology, communication technology, and data processing technology to transmit the short-range measurement values ​​of object parameters to a distant measurement station to achieve long-distance measurement.

[0076] (13) Type 2 routing, also known as MAC / IP routing, is used to advertise MAC and IP address information.

[0077] (14) A host table is a mapping table used in computer networks to associate IP address information with corresponding host names.

[0078] (15) The southbound interface is the communication protocol between the controller and the switch (gateway, policy execution node, terminal).

[0079] In order to realize the policy following of the terminal IPv6 service traffic, a policy following method provided in an embodiment of the present application can realize the policy following of the terminal IPv6 service traffic by generating a second mapping relationship between the IPv6 address information and the user group, and determining the traffic policy of the IPv6 address information according to the second mapping relationship. Among them, the method and device described in the embodiment of the present application are based on the same technical concept. Since the principles of the problems solved by the method and the device are similar, the embodiments of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0080] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method may be executed or executed in parallel in the actual processing process or when the device is executed in accordance with the method sequence shown in the embodiment or drawings.

[0081] Figure 1 The flow chart of a policy accompanying method provided in an embodiment of the present application is applied to software defined network SDN. The process can be executed by a policy accompanying device, which can be implemented by software, hardware, or a combination of software and hardware to ensure the normal operation of the system. Figure 1 As shown, the process includes the following steps:

[0082] S11, in response to a user operation of selecting a target recognition mode, acquiring a first mapping relationship and a message of a terminal;

[0083] S12, generating a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

[0084] S13, determining a traffic policy for the IPv6 address information according to the second mapping relationship;

[0085] In an embodiment of the present application, when the network is configured, the controller in the SDN obtains the organizational relationship (user group) within the organization from servers such as LDAP and OA, and sends the user group and its corresponding traffic policy to the policy execution node in the SDN.

[0086] Optionally, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

[0087] Exemplarily, the use scenario of the controller identification mode is: when the gateway in the SDN is not configured as a policy execution node, and there is no Border Gateway Protocol (BGP) neighbor relationship configured between the gateway and the policy execution node. Figure 2 As shown, a signaling interaction diagram of a controller identification mode provided in an embodiment of the present application includes:

[0088] A first mapping relationship of the terminal is obtained based on a controller in the SDN, wherein the first mapping relationship represents a relationship between MAC address information, IPv4 address information and a user group of the terminal. A specific method for obtaining the first mapping relationship may be:

[0089] The terminal initiates an authentication request to the authentication device in the SDN. After receiving the authentication request, the authentication device sends the authentication request and the billing message to the controller through RADIUS. After receiving the authentication request and the billing message, the controller performs proxy authentication, for example, sends the authentication request to the authentication server in the SDN. After the authentication is successful, the authentication server returns the authentication pass information to the controller, so that the controller returns the authentication pass information to the terminal via the authentication device. At this point, the terminal authentication is successful. At the same time, the controller binds the IPv4 address information, MAC address information and user identity information of the terminal carried in the billing message, and combines the above-mentioned user group to generate the first mapping relationship between the terminal's MAC address information, IPv4 address information and user group.

[0090] At the same time, the controller obtains the terminal's message, such as ARP message and ND message. Specifically, first, the gateway in the SDN obtains the terminal's message and sends the message to the controller, for example, through NETCONF, GRPC or telemetry technology.

[0091] Further, after receiving the message, the controller parses the message to obtain a third mapping relationship between the terminal's MAC address information and the IPv6 address information, and compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the above-mentioned user group.

[0092] Finally, the controller sends the second mapping relationship to the policy execution node in the SDN, so that the policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the policy execution node also installs the second mapping relationship into the host table.

[0093] Through the above method, the above message is sent to the controller based on the gateway, and the authentication device does not need to support IPv6 authentication function and audit function, thereby realizing the decoupling of the authentication device.

[0094] Exemplarily, the use scenario of the local EVPN identification mode is: the gateway in the SDN is not configured as a policy execution node, and a BGP neighbor relationship is configured between the gateway and the policy execution node. Figure 3 As shown, it is a signaling interaction diagram of the local EVPN identification mode provided in an embodiment of the present application, including:

[0095] The policy execution node in the SDN obtains the terminal's message, such as ARP message and ND message. Specifically, the gateway in the SDN obtains the terminal's message and sends the message to the policy execution node through BGP, for example, through the Type 2 route of EVPN.

[0096] When receiving the message, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0097] At the same time, the first mapping relationship of the terminal is obtained through the controller in the SDN, wherein the specific method for obtaining the first mapping relationship is consistent with the method for obtaining the first mapping relationship in the controller identification mode, and will not be described repeatedly here. And the controller will send the first mapping relationship to the policy execution node through the southbound interface.

[0098] When receiving the first mapping relationship, the policy execution node compares the first mapping relationship with the third mapping relationship to generate a second mapping relationship between the terminal's IPv6 address information and the user group; determines the traffic policy of the IPv6 address information based on the second mapping relationship; and installs the second mapping relationship into the host table.

[0099] Finally, the policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the policy execution node also installs the second mapping relationship into the host table.

[0100] Through the above method, the above message is synchronized based on EVPN, and there is no need to add a new private protocol to transmit the binding relationship between IPv6 address information and MAC address information, which can reduce the performance consumption of the policy execution node. At the same time, the policy execution node performs the mapping association between IPv6 address information and user groups, and implements the delivery of IPv4 policies while delivering IPv6 policies. There is no need to deliver IPv6 address information to the controller in real time through billing messages, which can reduce the interaction between the policy execution node and the controller and improve the performance of the policy execution node and the controller.

[0101] Exemplarily, the use scenario of the local gateway identification mode is: the gateway in the SDN is configured as a policy execution node. Figure 4 As shown, a signaling interaction diagram of a local gateway identification mode provided in an embodiment of the present application includes:

[0102] The controller in the SDN obtains the first mapping relationship of the terminal, wherein the specific method for obtaining the first mapping relationship is consistent with the method for obtaining the first mapping relationship in the controller identification mode, and is not described repeatedly here. The controller sends the first mapping relationship to the gateway through the southbound interface.

[0103] At the same time, the gateway in the SDN obtains the terminal's message, such as ARP message and ND message. When the gateway obtains the message, it can obtain the third mapping relationship between the terminal's MAC address information and IPv6 address information by parsing the message.

[0104] Further, the gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, and then the gateway determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the gateway notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the gateway also installs the second mapping relationship into the host table.

[0105] Through the above method, when the gateway in the SDN is configured as a policy execution node, there is no need to send messages to the controller. The IPv6 address information of the terminal is directly associated with the user group based on the gateway to achieve policy-based mobility of the terminal IPv6 service traffic.

[0106] It should be noted that in the above embodiments, there is no restriction on the number of policy execution nodes and terminals. The terminals include but are not limited to: mobile phones, tablet computers, laptop computers, PDAs, mobile Internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in unmanned driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.

[0107] Based on the same inventive concept, the embodiment of the present application also provides a strategy accompanying device, such as Figure 5 FIG. 1 is a schematic diagram of a structure of a policy accompanying device provided in an embodiment of the present application, wherein the device is applied to a software defined network (SDN), and the device includes:

[0108] An acquisition module 51 is used to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents a relationship between the MAC address information, the IPv4 address information and the user group of the terminal;

[0109] A generating module 52, configured to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

[0110] The accompanying policy module 53 is used to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

[0111] In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

[0112] In a possible design, the acquisition module 51 is specifically used for:

[0113] In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN;

[0114] The generating module 52 is specifically used for:

[0115] Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0116] Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0117] In a possible design, the acquisition module 51 is further used for:

[0118] In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN;

[0119] The generating module 52 is also used for:

[0120] The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0121] The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

[0122] In a possible design, the acquisition module 51 is further used for:

[0123] In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN;

[0124] The generating module 52 is also used for:

[0125] The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0126] The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0127] The above-mentioned policy accompanying device generates a second mapping relationship between the IPv6 address information and the user group, and determines the traffic policy of the IPv6 address information according to the second mapping relationship, thereby realizing the policy accompanying of the terminal IPv6 service traffic.

[0128] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, and the electronic device can realize the functions of the aforementioned policy accompanying device, referring to Figure 6 , the electronic device comprises:

[0129] At least one processor 61, and a memory 62 connected to the at least one processor 61. The specific connection medium between the processor 61 and the memory 62 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 61 and the memory 62 are connected via a bus 60. The bus 60 is Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 60 can be divided into an address information bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 61 can also be called a controller, and there is no limitation on the name.

[0130] In the embodiment of the present application, the memory 62 stores instructions that can be executed by at least one processor 61. The at least one processor 61 can execute the policy accompanying method discussed above by executing the instructions stored in the memory 62. The processor 61 can implement Figure 5 The functions of each module in the device shown.

[0131] Among them, the processor 61 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 62 and calling data stored in the memory 62, the various functions of the device and processing data, the device can be monitored as a whole.

[0132] In a possible design, the processor 61 may include one or more processing units, and the processor 61 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 61. In some embodiments, the processor 61 and the memory 62 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0133] The processor 61 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the policy accompanying method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0134] The memory 62 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 62 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 62 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 62 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0135] By programming the processor 61, the code corresponding to the strategy accompanying method described in the above embodiment can be fixed into the chip, so that the chip can execute the strategy accompanying method when running. Figure 1 The steps of the policy following method of the embodiment shown are as follows: How to design and program the processor 61 is a technology well known to those skilled in the art and will not be described in detail here.

[0136] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the policy accompanying method discussed above.

[0137] In some possible implementations, various aspects of the policy accompanying method provided by the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps of the policy accompanying method according to various exemplary embodiments of the present application described above in this specification.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0139] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0142] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A strategy following method, characterized in that: The method is applied to a software defined network (SDN), and the method comprises: In response to a user operation of selecting a target identification mode, obtaining a first mapping relationship and a message of a terminal, wherein the first mapping relationship represents a relationship between MAC address information, IPv4 address information and a user group of the terminal; Generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message; Determine a traffic policy for the IPv6 address information according to the second mapping relationship.

2. The method according to claim 1, characterized in that The target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

3. The method according to claim 2, characterized in that The step of obtaining a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode includes: In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN; The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes: Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal; Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

4. The method according to claim 2, characterized in that The step of obtaining a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode includes: In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN; The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes: The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal; The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

5. The method according to claim 2, characterized in that The step of obtaining a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode includes: In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN; The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes: The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal; The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

6. A policy companion device, characterized in that: The device is applied to a software defined network (SDN), and the device comprises: An acquisition module, configured to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents a relationship between the MAC address information, the IPv4 address information and the user group of the terminal; A generating module, configured to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message; A policy accompanying module is used to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

7. The device according to claim 6, characterized in that The target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

8. The device according to claim 7, characterized in that The acquisition module is specifically used for: In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN; The generation module is specifically used for: Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal; Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 5 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 5 are implemented.

Images