Method and device for realizing segmented routing by expanding WIREGUARD protocol

Abstract

The invention provides a method and a device for realizing segmented routing by expanding a WIREGUARD protocol. The method comprises the following steps that: a management plane respectively issues routing information to an access point and a transit point, and inserts a first transit point route into the access point; when the first relay point receives the routing information, the first relay point forwards a preset wireguide protocol packet to a second relay point; the second transfer point forwards the routing information to a destination access point according to the preset wireguide protocol packet; and the access point sends a request, and forwards the request to a destination access point according to a route planned by the preset wireguide protocol packet. Segmented routing is achieved by expanding the WIREGUARD protocol, hardware supporting a special protocol does not need to be introduced into a transit point, and complex configuration is not needed; the access point is a common wireguide protocol access point and does not need to be transformed; a backbone network does not need to be transformed. The access point and the transit point can be deployed at different nodes of the backbone network, and the service level can be improved through a private line.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for implementing segmented routing by extending the WIREGUARD protocol. Background Art

[0002] MPLS (Multi-Protocol Label Switching) and SRv6 (Segment Routing Technology Based on IPv6 Forwarding Plane) are both network technologies used to improve the transmission efficiency and path control capability of data packets in the network. MPLS is widely used in VPN (Virtual Private Network), traffic engineering, QoS (Quality of Service), etc. MPLS-based VPN can create a private network with security similar to FR (Frame Relay) network. User equipment does not need to configure GRE, L2TP and other tunnels for VPN, and network latency is minimized. MPLS-based traffic engineering can transfer business flows from the shortest path calculated by IGP to possible, unblocked physical paths in the network. By controlling the path taken by IP packets in the network, business flows are avoided to already congested nodes, realizing the rational use of network resources. SRv6 is implemented by inserting the SRH extension header into the IPv6 message. The SRH contains an explicit IPv6 address stack, and the intermediate nodes continuously update the destination address and offset address stack to complete hop-by-hop forwarding. The SRv6 SID (Segment Identifier) ​​format consists of three parts: locator, function, and arguments, where arguments is an optional field.

[0003] MPLS, SRv6 and other protocols require specific hardware support to solve segment routing and route planning. This makes their application cost relatively high and requires large-scale transformation of the backbone network, which has a great impact on the existing network. Summary of the invention

[0004] The present application shows a method and device for implementing segmented routing by extending the WireGuard protocol.

[0005] In a first aspect, the present application shows a method for implementing segment routing by extending the WireGuard protocol, the method comprising:

[0006] The management plane sends routing information to the access point and the transit point respectively, and inserts the first transit point route into the access point;

[0007] When the first transit point receives the routing information, it forwards the preset wireguard protocol packet to the second transit point;

[0008] The second transit point forwards the routing information to the destination access point according to the preset wireguard protocol package;

[0009] The access point sends a request and forwards it to the destination access point according to the route planned by the preset wireguard protocol packet.

[0010] In an exemplary embodiment of the present disclosure, the method further includes:

[0011] The access point is a standard wireguard node;

[0012] The transit point is a WireGuard node that extends the WireGuard protocol.

[0013] In an exemplary embodiment of the present disclosure, the method further includes:

[0014] The wireguard protocol is expanded by modifying the source code of the wireguard protocol and adding a transit mode.

[0015] In an exemplary embodiment of the present disclosure, the method further includes:

[0016] The access point also includes a communication entry point endpoint for accessing the service. When the management plane sends routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

[0017] In an exemplary embodiment of the present disclosure, the method further includes:

[0018] When the management plane sends the routing information to the access point and the transfer point respectively, the routing information is forwarded through the first transfer point.

[0019] In an exemplary embodiment of the present disclosure, the method further includes:

[0020] Establishing a segment routing system by extending the WireGuard protocol and deploying a preset number of transit points for the system;

[0021] The system includes a centralized management plane system and a distributed control plane center.

[0022] In an exemplary embodiment of the present disclosure, the method further includes:

[0023] The data format of the access point sent by the management plane includes the first peer public key, the public endpoint of the first peer node, and the first security group node IP address;

[0024] The data format sent by the management plane to the control plane includes the second peer public key, the public endpoint of the second peer node, latency, bandwidth, packet loss rate, and service level agreement SLA;

[0025] The data format of the transfer node sent by the control plane includes the third peer public key, the public endpoint of the third peer node, and the IP address of the next security group node.

[0026] In a second aspect, the present application shows a device for implementing segment routing by extending the WireGuard protocol, the device comprising:

[0027] A management plane sending module, used for the management plane to send routing information to the access point and the transit point respectively, and insert the first transit point route into the access point;

[0028] A first forwarding module, configured to forward a preset wireguard protocol packet to a second transfer point when the first transfer point receives routing information;

[0029] A second forwarding module, configured for the second transit point to forward the routing information to a destination access point according to the preset wireguard protocol packet;

[0030] The global forwarding module is used for forwarding a request sent by an access point to a destination access point according to a route planned by the preset wireguard protocol packet.

[0031] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any of the above aspects.

[0032] In a fourth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as described in any of the above aspects.

[0033] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0034] The technical solution method provided by the present application includes: the management plane sends routing information to the access point and the transit point respectively, and inserts the route of the first transit point into the access point; when the first transit point receives the routing information, it forwards the preset wireguard protocol package to the second transit point; the second transit point forwards the routing information to the destination access point according to the preset wireguard protocol package; the access point sends a request and forwards it to the destination access point according to the route planned by the preset wireguard protocol package. The present disclosure implements segmented routing by extending the WIREGUARD protocol, including the following beneficial effects: the transit point does not need to introduce hardware that supports special protocols, and does not require complex configuration; the access point is an ordinary wireguard protocol access point and does not need to be modified; there is no need to modify the backbone network. Access points and transit points can be deployed at different nodes of the backbone network, and the service level can also be improved through dedicated lines. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flowchart of the steps of a method for implementing segmented routing by extending the WireGuard protocol in the present application.

[0036] Figure 2 This is a business planning diagram of a method for implementing segmented routing by extending the WireGuard protocol in the present application.

[0037] Figure 3 This is a structural block diagram of a device for implementing segment routing by extending the WIREGUARD protocol in the present application.

[0038] Figure 4 It is a block diagram of an electronic device of the present application.

[0039] Figure 5 It is a block diagram of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] The method disclosed in the present invention for implementing segment routing by extending the WireGuard protocol comprises the following steps:

[0042] Step S110, the management plane sends routing information to the access point and the transit point respectively, and inserts the first transit point route into the access point;

[0043] Step S120, when the first transit point receives the routing information, the preset wireguard protocol packet is forwarded to the second transit point;

[0044] Step S130, the second transit point forwards the routing information to the destination access point according to the preset wireguard protocol package;

[0045] Step S140: the access point sends a request and forwards it to the destination access point according to the route planned by the preset wireguard protocol packet.

[0046] The technical solution method provided by the present application includes: the management plane sends routing information to the access point and the transit point respectively, and inserts the route of the first transit point into the access point; when the first transit point receives the routing information, it forwards the preset wireguard protocol package to the second transit point; the second transit point forwards the routing information to the destination access point according to the preset wireguard protocol package; the access point sends a request and forwards it to the destination access point according to the route planned by the preset wireguard protocol package. The present disclosure implements segmented routing by extending the WIREGUARD protocol, including the following beneficial effects: the transit point does not need to introduce hardware that supports special protocols, and does not require complex configuration; the access point is an ordinary wireguard protocol access point and does not need to be modified; there is no need to modify the backbone network. Access points and transit points can be deployed at different nodes of the backbone network, and the service level can also be improved through dedicated lines.

[0047] Wireguard: A virtual point-to-point networking method implemented in the Linux kernel, widely used in VPN networking.

[0048] Segment routing: Based on different protocol standards such as MPLS or SRv6, segment routing of IP packets in the backbone network is implemented to plan network paths. For example, if an IP packet is sent from a Beijing node to a Shanghai node, it will first go to Hefei, then to Inner Mongolia, then to Tianjin, and then to Beijing. It is necessary to add segment information (generally called labels) to the IP packet, and the router that supports this protocol completes routing forwarding according to the labels.

[0049] Embodiment 1:

[0050] Reference Figure 1 , shows a flowchart of the steps of a method for implementing segment routing by extending the WireGuard protocol of the present application, the method can be applied to electronic devices, wherein the method specifically may include the following steps:

[0051] In step S110, the management plane may send routing information to the access point and the transit point respectively, and insert the first transit point route into the access point.

[0052] In the embodiment of this example, the method further includes:

[0053] The access point is a standard wireguard node;

[0054] The transit point is a WireGuard node that extends the WireGuard protocol.

[0055] In the embodiment of this example, the method further includes:

[0056] The wireguard protocol is expanded by modifying the source code of the wireguard protocol and adding a transit mode.

[0057] In step S120, when the first transit point receives the routing information, the preset wireguard protocol packet may be forwarded to the second transit point.

[0058] In the embodiment of this example, the method further includes:

[0059] The access point also includes a communication entry point endpoint for accessing the service. When the management plane sends routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

[0060] In the embodiment of this example, the method further includes:

[0061] When the management plane sends the routing information to the access point and the transfer point respectively, the routing information is forwarded through the first transfer point.

[0062] In step S130, the second transit point may forward the routing information to the destination access point according to the preset wireguard protocol package.

[0063] In the embodiment of this example, the method further includes:

[0064] Establishing a segment routing system by extending the WireGuard protocol and deploying a preset number of transit points for the system;

[0065] The system includes a centralized management plane system and a distributed control plane center.

[0066] In step S140, the access point may send a request and forward it to the destination access point according to the route planned by the preset wireguard protocol packet.

[0067] In the embodiment of this example, the method further includes:

[0068] The data format of the access point sent by the management plane includes the first peer public key peer pub key, the first peer node's public endpoint peer endpoint, and the first security group node IP address first sg node ip;

[0069] The data format sent by the management plane to the control plane includes the second peer public key peer pub key, the public endpoint peer endpoint of the second peer node, latency, bandwidth, packet loss rate packet-lost, and service level agreement SLA;

[0070] The data format of the transfer node sent by the control plane includes the third peer public key peer pub key, the public endpoint peer endpoint of the third peer node, and the next security group node IP address next sg node ip.

[0071] The present invention implements segmented routing by extending the WireGuard protocol, and can implement large-scale segmented routing deployment within the existing framework, thereby meeting requirements for path planning, service level, etc.

[0072] Embodiment 2:

[0073] like Figure 2 As shown, in the embodiment of this example, the management plane can send routing information to the access point and the transit point respectively, and insert the first transit point route into the access point.

[0074] In the embodiment of this example, the method further includes:

[0075] The access point is a standard wireguard node;

[0076] The transit point is a WireGuard node that extends the WireGuard protocol.

[0077] In the embodiment of this example, the method further includes:

[0078] The wireguard protocol is expanded by modifying the source code of the wireguard protocol and adding a transit mode.

[0079] In the embodiment of this example, the access point is a standard wireguard node, including the endpoint of the opposite end. When sending a request, it is sent according to the standard wireguard protocol. The management plane sends instructions to the access point and inserts the first transit point route to the access point. For example, the IP of the Tun device of access point A is 10.1.1.1, the IP of the opposite end endpoint is the public network IP 142.29.29.29, and the address of the opposite end to be accessed is the intranet IP 10.2.2.2.

[0080] In step S120, when the first transit point receives the routing information, the preset wireguard protocol packet may be forwarded to the second transit point.

[0081] In the embodiment of this example, the method further comprises:

[0082] The access point also includes a communication entry point endpoint for accessing the service. When the management plane sends routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

[0083] In the embodiment of this example, the method further comprises:

[0084] When the management plane sends the routing information to the access point and the transfer point respectively, the routing information is forwarded through the first transfer point.

[0085] In the embodiment of this example, the management plane sends routing information to the access point and the transit point respectively, including: when 10.1.1.1 accesses 142.29.29.29, it is forwarded through transit point 1; when transit point 1 receives a request from a tenant, it forwards the wireguard protocol packet to transit point 2.

[0086] In step S130, the second transit point may forward the routing information to the destination access point according to the preset wireguard protocol package.

[0087] In the embodiment of this example, the method further comprises:

[0088] Establishing a segment routing system by extending the WireGuard protocol and deploying a preset number of transit points for the system;

[0089] The system includes a centralized management plane system and a distributed control plane center.

[0090] In this exemplary embodiment, transit point 2 forwards the message to the destination access point.

[0091] In step S140, the access point may send a request and forward it to the destination access point according to the route planned by the preset wireguard protocol packet.

[0092] In the embodiment of this example, when the access point sends a request, it must be forwarded to the destination according to the previously planned route.

[0093] In the embodiment of this example, a zero-trust network system for enterprises is implemented based on this solution. The main points of the system are as follows:

[0094] The system deploys multiple transfer points across the country, and each transfer point is a standard transfer point of the system;

[0095] The system includes a centralized management system to complete enterprise registration, management, user and permission management;

[0096] The system includes multiple control plane centers that are deployed in a distributed manner. Each control plane center is responsible for a set of transfer points in a region, and the centers exchange routing information through instructions issued by the management plane;

[0097] The system includes the user's client. The client completes user login, route acquisition, and DNS acquisition by interacting with the management plane;

[0098] Enterprise users register as tenants through the management plane of this system and set service levels, such as VIP. Each service level corresponds to the requirements of latency, bandwidth and packet loss rate. The system will deploy access points for multiple different areas of the enterprise. The system sends the service level to the control plane to generate segmented routing and sends it to the transit point. After the end users of the enterprise download and install the client, they can complete network access and enjoy the segmented routing service;

[0099] The system adjusts the deployment of transit points according to the load conditions, including capacity, number of nodes, dedicated line connection, etc.

[0100] Embodiment three:

[0101] In the embodiment of this example, the basic process of the present invention is:

[0102] The transit point is an extension of the wireguard protocol. The wireguard protocol does not distinguish between "clients" and "servers". It is a point-to-point networking protocol that does not support multi-node transit and tenant division. By modifying the wireguard protocol source code, the "transit mode" is added. When the wireguard node is started, it is started as an "access point" or "transit point" through the instructions sent by the management plane. In the transit point mode, it receives instructions from the control plane and configures the transit route. After the transit point receives the wireguard protocol packet, it queries the transit route according to the information of the other end and decides to send the protocol packet to the next node to achieve segmented routing. After receiving the protocol packet, the wireguard protocol reversely searches for the information of the other end according to the destination IP address and matches it. This will cause the IP addresses of different tenants to overlap each other if they are repeated. Therefore, the transit point distinguishes the IP addresses of different tenants by combining the pub key of the other end and the destination IP. The management plane sends the service levels of different tenants (such as VIP, ordinary) to the control plane to plan the route. Each access point and transit point can be connected by a dedicated line or the public network.

[0103] In the embodiment of this example, the main data formats include:

[0104] 1. The management plane issues access points: peer pub key, peer endpoint, first sg node ip, etc. The peer endpoint is the access point close to the enterprise intranet, usually located on the customer side; and the first sg node ip is dynamically selected by the management plane based on the access point information (including location, terminal equipment) to enhance service level assurance. Both ips can be adjusted dynamically. The management plane also needs to issue DNS information.

[0105] 2. The management plane sends the control plane: peer pub key, peer endpoint, latency, bandwidth, packet-lost, SLA, etc. Latency, bandwidth, packet loss rate, SLA, etc. define the channel requirements of the tenant.

[0106] 3. The control plane sends the transfer node: peer pub key, peer endpoint, next sg node ip, etc. The control plane calculates the tenant's channel requirements, obtains routing information, and sends it to the transfer node. The transfer node forwards the received protocol packet based on the information.

[0107] The system uses measurement information to perceive and optimize route planning.

[0108] In this example embodiment, the main collected information includes:

[0109] 1) Access point logs are uploaded regularly, including metrics of TUN devices, etc.

[0110] 2) Metrics of the TUN device at the transit point, routing update logs, etc.

[0111] In the embodiment of this example, the present invention is based on the following main technical points:

[0112] 1. Extend the wireguard protocol so that it can be applied to segment routing implementation;

[0113] 2. A segmented routing architecture with management plane, control plane, and data plane separated based on WireGuard and Linux TCP / IP;

[0114] 3. Implementation of segmented routing without modifying the backbone network.

[0115] Compared with the prior art, the following beneficial effects are achieved:

[0116] 1. The transfer point does not need to introduce hardware that supports special protocols, and does not require complex configuration;

[0117] 2. The access point is a common WireGuard protocol access point and does not require modification;

[0118] 3. No need to transform the backbone network. Access points and transfer points can be deployed at different nodes of the backbone network, and the service level can also be improved through dedicated lines;

[0119] 4. Low cost.

[0120] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0121] Reference Figure 3 , shows a structural block diagram of a device for implementing segment routing by extending the WIREGUARD protocol of the present application, the device comprising a management plane sending module 210, a first forwarding module 220, a second forwarding module 230 and a global forwarding module 240:

[0122] The management plane sending module 210 is used for the management plane to send routing information to the access point and the transit point respectively, and insert the first transit point route into the access point;

[0123] A first forwarding module 220, configured to forward a preset wireguard protocol packet to a second transfer point when the first transfer point receives routing information;

[0124] A second forwarding module 230, configured for the second transit point to forward the routing information to a destination access point according to the preset wireguard protocol packet;

[0125] The global forwarding module 240 is used for forwarding a request sent by an access point to a destination access point according to a route planned by the preset wireguard protocol packet.

[0126] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0127] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0128] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0129] Figure 4 800 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0130] Reference Figure 4 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0131] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0132] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0133] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0134] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0135] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0136] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0137] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0138] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0139] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0140] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0141] Figure 5 19 is a block diagram of a computer-readable storage medium 1900 shown in the present application. For example, the computer-readable storage medium 1900 may be provided as a server.

[0142] Reference Figure 5 , the computer-readable storage medium 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0143] The computer readable storage medium 1900 may also include a power supply component 1926 configured to perform power management of the computer readable storage medium 1900, a wired or wireless network interface 1950 configured to connect the computer readable storage medium 1900 to a network, and an input / output (I / O) interface 1958. The computer readable storage medium 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0144] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0145] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0146] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0147] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0149] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0152] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0153] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for implementing segment routing by extending the wireguard protocol, characterized in that: The method comprises: The management plane sends routing information to the access point and the transit point respectively, and inserts the first transit point route into the access point; When the first transit point receives the routing information, the preset wireguard protocol packet is forwarded to the second transit point; The second transit point forwards the routing information to the destination access point according to the preset wireguard protocol package; The access point sends a request and forwards it to the destination access point according to the route planned by the preset wireguard protocol package.

2. The method according to claim 1, characterized in that The method further comprises: The access point is a standard wireguard node; The transit point is a WireGuard node that extends the WireGuard protocol.

3. The method according to claim 2, characterized in that The method further comprises: The wireguard protocol is expanded by modifying the source code of the wireguard protocol and adding a transit mode.

4. The method according to claim 1, characterized in that The method further comprises: The access point also includes a communication entry point endpoint for accessing the service. When the management plane sends routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

5. The method according to claim 4, characterized in that The method further comprises: When the management plane sends the routing information to the access point and the transfer point respectively, the routing information is forwarded through the first transfer point.

6. The method according to claim 1, characterized in that The method further comprises: Establishing a segment routing system by extending the WireGuard protocol and deploying a preset number of transit points for the system; The system includes a centralized management plane system and a distributed control plane center.

7. The method according to claim 6, characterized in that The method further comprises: The data format of the access point sent by the management plane includes the first peer public key, the public endpoint of the first peer node, and the first security group node IP address; The data format sent by the management plane to the control plane includes the second peer public key, the public endpoint of the second peer node, latency, bandwidth, packet loss rate, and service level agreement SLA; The data format of the transfer node sent by the control plane includes the third peer public key, the public endpoint of the third peer node, and the IP address of the next security group node.

8. A device for implementing segment routing by extending the wireguard protocol, characterized in that: The device comprises: A management plane sending module, used for the management plane to send routing information to the access point and the transit point respectively, and insert the first transit point route into the access point; A first forwarding module, configured to forward a preset wireguard protocol packet to a second transfer point when the first transfer point receives routing information; A second forwarding module, configured for the second transit point to forward the routing information to a destination access point according to the preset wireguard protocol packet; The global forwarding module is used for forwarding a request sent by an access point to a destination access point according to a route planned by the preset wireguard protocol packet.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images