A method and device for implementing segment routing by extending a WIREGUARD protocol

Abstract

The application provides a method and device for realizing segment routing by extending a WIREGUARD protocol. The method comprises the following steps: a management plane respectively issues routing information to an access point and a transit point, and inserts first transit point routing into the access point; when the first transit point receives the routing information, the first transit point forwards a preset wireguard protocol packet to a second transit point; the second transit point forwards the routing information to a destination access point according to the preset wireguard protocol packet; and the access point sends a request and forwards to the destination access point according to the routing planned by the preset wireguard protocol packet. The disclosure realizes segment routing by extending the WIREGUARD protocol, and the transit point does not need to introduce hardware supporting a special protocol and does not need complex configuration; the access point is a normal wireguard protocol access point and does not need to be modified; and the backbone network does not need to be modified. The access point and the transit point can be deployed at different nodes of the backbone network, and the service level can be improved through a dedicated line.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a method and device for realizing segment routing by extending a WIREGUARD protocol. BACKGROUND

[0002] MPLS (Multi-Protocol Label Switching) and SRv6 (Segment Routing over IPv6) are network technologies for improving the transmission efficiency and path control capability of data packets in a network. MPLS is widely used in VPN (Virtual Private Network), traffic engineering, QoS (Quality of Service), and the like. VPN based on MPLS can create a private network with security similar to an FR (Frame Relay) network, and user equipment does not need to configure GRE, L2TP, and the like for the VPN, and network latency is minimized. Traffic engineering based on MPLS can transfer service flows from the shortest path calculated by IGP to possible unblocked physical paths in the network, avoid service flows to congested nodes by controlling the path of IP packets in the network, and realize rational use of network resources. SRv6 is implemented by inserting an SRH extension header in an IPv6 packet, and the SRH contains an explicit IPv6 address stack, and the destination address and offset address stack are constantly updated by intermediate nodes to complete hop-by-hop forwarding. The SRv6 SID (Segment Identifier) format consists of a locator, a function, and arguments, wherein the arguments are optional fields.

[0003] Protocols such as MPLS and SRv6 need specific hardware support to solve segment routing and routing planning. This makes their application cost relatively high, and large-scale reconstruction of the backbone network is required, which has a greater impact on the existing network. SUMMARY

[0004] The present application shows a method and device for realizing segment routing by extending a wireguard protocol.

[0005] In a first aspect, the present application shows a method for realizing segment routing by extending a wireguard protocol, the method comprising:

[0006] The management plane respectively issues routing information to the access point and the transit point, and inserts the first transit point routing into the access point.

[0007] The first transit point forwards the preset wireguard protocol packet to the second transit point when receiving the routing information;

[0008] The second transit point forwards the routing information to the destination access point according to the preset wireguard protocol packet;

[0009] The access point sends a request and forwards to the destination access point according to the routing planned by the preset wireguard protocol packet.

[0010] In an exemplary embodiment of the present disclosure, the method further comprises:

[0011] The access point is a standard wireguard node;

[0012] The transit point is a wireguard node extended to the wireguard protocol.

[0013] In an exemplary embodiment of the present disclosure, the method further comprises:

[0014] The wireguard protocol is extended by adding a transit mode through source code modification.

[0015] In an exemplary embodiment of the present disclosure, the method further comprises:

[0016] The access point further comprises a communication entry point endpoint for proxy access service, and when the management plane separately issues routing information to the access point, the routing information comprises an access point IP address and an endpoint IP address.

[0017] In an exemplary embodiment of the present disclosure, the method further comprises:

[0018] When the management plane separately issues routing information to the access point and the transit point, the routing information is forwarded through the first transit point.

[0019] In an exemplary embodiment of the present disclosure, the method further comprises:

[0020] A segmented routing system is established by extending the wireguard protocol, and a preset number of transit points are deployed for the system;

[0021] The system comprises a centralized management plane system and a distributed control plane center.

[0022] In an exemplary embodiment of the present disclosure, the method further comprises:

[0023] The data format of the management plane issuing the access point includes a first peer public key, a first peer node public endpoint, and a first security group node IP address.

[0024] The data format of the management plane issuing the control plane includes a second peer public key, a second peer node public endpoint, a delay, a bandwidth, a packet loss rate, and a service level agreement (SLA).

[0025] The data format of the control plane issuing the transit node includes a third peer public key, a third peer node public endpoint, and a next security group node IP address.

[0026] In a second aspect, the present application shows a device for implementing segment routing by extending the wireguard protocol, the device comprising:

[0027] A management plane issuing module for issuing routing information to an access point and a transit point on the management plane, and inserting a first transit point routing into the access point.

[0028] A first forwarding module for forwarding a preset wireguard protocol packet to a second transit point when the first transit point receives the routing information.

[0029] A second forwarding module for forwarding the routing information to a destination access point according to the preset wireguard protocol packet.

[0030] A global forwarding module for an access point to issue a request and forward to a destination access point according to a routing planned by the preset wireguard protocol packet.

[0031] In a third aspect, the present application shows an electronic device, comprising a processor, a memory for storing processor-executable instructions, wherein the processor is configured to execute the method of any of the above aspects.

[0032] In a fourth aspect, the present application shows a non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the method of any of the above aspects.

[0033] In a fifth aspect, the present application shows a computer program product, when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device can execute the method of any of the above aspects.

[0034] The technical scheme provided by the application comprises the following steps: a management plane respectively issues routing information to an access point and a transit point, and inserts a first transit point routing into the access point; the first transit point forwards a preset wireguard protocol packet to a second transit point when receiving the routing information; the second transit point forwards the routing information to a destination access point according to the preset wireguard protocol packet; and the access point forwards to the destination access point according to the routing planned by the preset wireguard protocol packet. The disclosure realizes segmented routing by extending the WIREGUARD protocol, and has the following beneficial effects: the transit point does not need to introduce hardware supporting a special protocol, and does not need complex configuration; the access point is a normal wireguard protocol access point, and does not need to be modified; and the backbone network does not need to be modified. The access point and the transit point can be deployed at different nodes of the backbone network, and can also be deployed through a dedicated line to improve service level. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a step flow chart of a method for realizing segmented routing by extending a wireguard protocol according to the application.

[0036] Figure 2 is a business planning diagram of a method for realizing segmented routing by extending a wireguard protocol according to the application.

[0037] Figure 3 is a structural block diagram of an apparatus for realizing segmented routing by extending a WIREGUARD protocol according to the application.

[0038] Figure 4 is a block diagram of an electronic device according to the application.

[0039] Figure 5 is a block diagram of a computer readable storage medium according to the application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are some of the embodiments of the application, but not all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the application.

[0041] The method for realizing segmented routing by extending a wireguard protocol according to the disclosure comprises the following steps:

[0042] In step S110, a management plane respectively issues routing information to an access point and a transit point, and inserts a first transit point routing into the access point;

[0043] Step S120, the first transit point forwards a preset wireguard protocol packet to the second transit point when the routing information is received.

[0044] Step S130, the second transit point forwards the routing information to the destination access point according to the preset wireguard protocol packet.

[0045] Step S140, the access point sends a request to forward to the destination access point according to the routing planned by the preset wireguard protocol packet.

[0046] The technical scheme provided by the present application comprises: the management plane respectively issues routing information to the access point and the transit point, and inserts the routing of the first transit point into the access point; the first transit point forwards a preset wireguard protocol packet to the second transit point when the routing information is received; the second transit point forwards the routing information to the destination access point according to the preset wireguard protocol packet; and the access point sends a request to forward to the destination access point according to the routing planned by the preset wireguard protocol packet. The disclosure realizes segmented routing by extending the WIREGUARD protocol, and has the following beneficial effects: the transit point does not need to introduce hardware supporting a special protocol, and does not need complex configuration; the access point is a normal wireguard protocol access point, and does not need to be modified; and the backbone network does not need to be modified. The access point and the transit point can be deployed at different nodes of the backbone network, and can also be deployed through a dedicated line to improve service level.

[0047] Wireguard: a virtual point-to-point networking method implemented in the Linux kernel, which is widely used in VPN networking.

[0048] Segmented routing: based on different protocol standards such as MPLS or SRv6, IP packets are segmented and routed in the backbone network, which is used to plan network paths. For example, IP packets from a Beijing node to a Shanghai node are routed through Hefei, Inner Mongolia, Tianjin, and Beijing. Segment information (generally referred to as labels) needs to be added to the IP packets to support routers supporting the protocol to complete routing forwarding according to the labels.

[0049] Embodiment one:

[0050] Referring to Figure 1 , a step flowchart of a method for realizing segmented routing by extending the wireguard protocol is shown, which can be applied to electronic equipment, and the method can specifically comprise the following steps:

[0051] In step S110, the management plane respectively issues routing information to the access point and the transit point, and inserts the routing of the first transit point into the access point.

[0052] In an embodiment of the present example, the method further comprises:

[0053] The access point is a standard wireguard node;

[0054] The transit point is a wireguard node extended to the wireguard protocol.

[0055] In an embodiment of the present example, the method further comprises:

[0056] The wireguard protocol is extended by source code modification to the wireguard protocol to add a transit mode.

[0057] In step S120, the preset wireguard protocol packet can be forwarded to the second transit point when the first transit point receives the routing information.

[0058] In an embodiment of the present example, the method further comprises:

[0059] The access point further includes a communication entry point endpoint for accessing services, and when the management plane separately issues routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

[0060] In an embodiment of the present example, the method further comprises:

[0061] When the management plane separately issues routing information to the access point and the transit point, the routing information is forwarded through the first transit point.

[0062] In step S130, the second transit point can forward the routing information to the destination access point according to the preset wireguard protocol packet.

[0063] In an embodiment of the present example, the method further comprises:

[0064] A segmented routing system is established by extending the wireguard protocol, and a preset number of transit points are deployed for the system;

[0065] The system includes a centralized management plane system and a distributed control plane center.

[0066] In step S140, the access point can issue a request to forward the routing according to the preset wireguard protocol packet to the destination access point.

[0067] In an embodiment of the present example, the method further comprises:

[0068] The data format of the management plane issuing the access point includes a first peer public key peer pub key, a first peer endpoint of the public endpoint of the peer endpoint, and a first security group node IP address first sg node ip.

[0069] The data format of the management plane issuing the control plane includes a second peer public key peer pub key, a second peer endpoint of the public endpoint of the peer endpoint, a delay latency, a bandwidth bandwidth, a packet loss rate packet-lost, and a service level agreement SLA.

[0070] The data format of the control plane issuing the transit node includes a third peer public key peer pub key, a third peer endpoint of the public endpoint of the peer endpoint, and a next security group node IP address next sg node ip.

[0071] The present application realizes segment routing by extending the wireguard protocol, and can realize large-scale segment routing deployment within the existing framework, thereby meeting the requirements of path planning, service level, etc.

[0072] Embodiment two:

[0073] As shown in Figure 2 In the embodiment of the present example, the routing information can be issued to the access point and the transit point by the management plane respectively, and the first transit point routing is inserted into the access point.

[0074] In the embodiment of the present example, the method further includes:

[0075] The access point is a standard wireguard node;

[0076] The transit point is a wireguard node extended from the wireguard protocol.

[0077] In the embodiment of the present example, the method further includes:

[0078] The wireguard protocol is extended by source code modification of the wireguard protocol and adding a transit mode.

[0079] In the embodiment of the present example, the access point is a standard wireguard node containing the endpoint of the opposite end. When sending a request, it is sent in the standard wireguard protocol. The management plane inserts the first transit point route to the access point by issuing instructions to the access point. For example, the IP of the Tun device of access point A is 10.1.1.1, the IP of the opposite end endpoint is public IP 142.29.29.29, and the address of the opposite end to be accessed is internal network IP 10.2.2.2.

[0080] In step S120, the preset wireguard protocol packet can be forwarded to the second transit point when the first transit point receives the routing information.

[0081] In the embodiment of the present example, the method further comprises:

[0082] In the access point, a communication entry point endpoint for accessing a service is further included. When the management plane issues routing information to the access point respectively, the routing information includes the IP address of the access point and the IP address of the endpoint.

[0083] In the embodiment of the present example, the method further comprises:

[0084] When the management plane issues routing information to the access point and the transit point respectively, the routing information is forwarded through the first transit point.

[0085] In the embodiment of the present example, the management plane issues routing information to the access point and the transit point respectively, including: when 10.1.1.1 accesses 142.29.29.29, forwarding through transit point 1; when the transit point 1 receives a request from a certain tenant, forwarding the wireguard protocol packet to the transit point 2.

[0086] In step S130, the second transit point can forward the routing information to the destination access point according to the preset wireguard protocol packet.

[0087] In the embodiment of the present example, the method further comprises:

[0088] A segmented routing system is established by extending the wireguard protocol, and a preset number of transit points are deployed for the system;

[0089] The system includes a centralized management plane system and a distributed control plane center.

[0090] In the embodiment of the present example, the transit point 2 forwards the packet to the destination access point.

[0091] In step S140, the access point sends a request to forward to the destination access point according to the preset wireguard protocol packet planning route.

[0092] In the embodiment of the present example, the access point sends a request to forward to the destination according to the route planned as before.

[0093] In the embodiment of the present example, the implementation of the enterprise-oriented zero-trust network system based on the present scheme. The main points of the system are as follows:

[0094] The system deploys multiple transit points in various parts of the country, and each transit point is a standard transit point of the system;

[0095] The system includes a centralized management plane system that completes enterprise registration, management, user and permission management;

[0096] The system includes multiple control plane centers deployed in a distributed manner. Each control plane center is responsible for a set of transit points in a region, and the centers exchange routing information through management plane instructions;

[0097] The system includes a user's client. The client completes user login, route acquisition, and DNS acquisition by interacting with the management plane;

[0098] Enterprise users register as tenants through the management plane of the system and set service levels such as VIP. Each service level corresponds to the requirements of latency, bandwidth, and packet loss rate. The system deploys access points for multiple different regions of the enterprise. The system issues service levels to the control plane to generate segmented routes and issues them to the transit points. After the end users of the enterprise download and install the client, they can complete network access and enjoy the segmented routing service;

[0099] The system adjusts the deployment of transit points according to the load, including capacity, node number, and dedicated line connection.

[0100] Embodiment three:

[0101] In the embodiment of the present example, the basic flow of the present application is:

[0102] The transit point is an extension of the wireguard protocol. The wireguard protocol does not distinguish between "clients" and "servers", and is a point-to-point networking protocol that does not support multi-node transit and does not support tenant division. By modifying the wireguard protocol source code, a "transit mode" is added. When the wireguard node starts, it receives instructions from the management plane to start as an "access point" or a "transit point". In transit point mode, receive instructions from the control plane, configure transit routing. After receiving the wireguard protocol packet, the transit point queries the transit routing according to the peer information, decides to send the protocol packet to the next node, and realizes segmented routing. The wireguard protocol receives the protocol packet, and then reversely looks up the peer information and matches according to the destination IP address. This will cause different tenant IP addresses to overlap each other if they are repeated, so the transit point distinguishes different tenant IP addresses by combining the peer pub key and the destination IP. The management plane sends different tenant service levels (such as VIP, ordinary) to the control plane to plan the routing. The access points and transit points can be connected by private lines or public networks.

[0103] In the embodiment of the present example, the main data format includes:

[0104] 1. The management plane issues access points: peer pub key, peer endpoint, first sg node ip, etc. Among them, the peer endpoint is an access point close to the enterprise intranet, usually located in the customer's site; and the first sg node ip is dynamically selected by the management plane according to the access point information (including location, terminal equipment) to enhance service level protection. Both of these two IPs can be dynamically adjusted. The management plane also needs to issue DNS information.

[0105] 2. The management plane issues control plane: peer pub key, peer endpoint, latency, bandwidth, packet-lost, SLA, etc. Latency, bandwidth, packet loss rate, SLA, etc. Define the channel requirements of this tenant.

[0106] 3. The control plane issues transit nodes: peer pub key, peer endpoint, next sg node ip, etc. The control plane calculates the routing information according to the channel requirements of the tenant and issues it to the transit node. The transit node sends the received protocol packet out according to the information.

[0107] The system senses and optimizes the routing plan through the measurement information.

[0108] In the embodiment of the present example, the main information collected includes:

[0109] 1) Access point log timing upload, including TUN device metrics, etc.

[0110] 2) TUN device metrics of the transit point, route update log, etc.

[0111] In the embodiment of the present example, the present application is based on the following main technical points:

[0112] 1. Extend the wireguard protocol to be applicable to the implementation of segment routing;

[0113] 2. Segment routing architecture based on wireguard and management plane, control plane, data plane separation of linux itself tcp / ip implementation;

[0114] 3. Implementation of segment routing without modifying the backbone network.

[0115] Compared with the prior art, the following beneficial effects are achieved:

[0116] 1. The transit point does not need to introduce hardware supporting special protocols, and does not need complex configuration;

[0117] 2. The access point is a normal wireguard protocol access point and does not need to be modified;

[0118] 3. The backbone network does not need to be modified. The access point and the transit point can be deployed at different nodes of the backbone network, and can also be deployed through a dedicated line to improve service level;

[0119] 4. Low cost.

[0120] It should be noted that for the method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the action sequence described, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0121] Referring to Figure 3 , a structure block diagram of an apparatus for implementing segment routing by extending the WIREGUARD protocol is shown, which comprises a management plane issuing module 210, a first forwarding module 220, a second forwarding module 230, and a global forwarding module 240:

[0122] The management plane issuing module 210 is used for issuing routing information to the access point and the transit point respectively in the management plane, and inserting the first transit point routing into the access point;

[0123] The first forwarding module 220 is configured to forward a preset wireguard protocol packet to the second transit point when the first transit point receives the routing information.

[0124] The second forwarding module 230 is configured to forward the routing information to a destination access point according to the preset wireguard protocol packet.

[0125] The global forwarding module 240 is configured to forward to the destination access point according to a route planned by the preset wireguard protocol packet when the access point sends a request.

[0126] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts refer to the part of the method embodiment.

[0127] Optionally, the embodiment of the application further provides an electronic device, including: a processor, a memory, a computer program stored in the memory and executable on the processor, the computer program is executed by the processor to realize the processes of the method embodiments, and the same technical effects can be achieved, to avoid repetition, which will not be repeated here.

[0128] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by the processor to realize the processes of the method embodiments, and the same technical effects can be achieved, to avoid repetition, which will not be repeated here. The computer readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0129] Figure 4 is a block diagram of an electronic device 800 shown in the application. For example, the electronic device 800 can be a mobile phone, a computer, a digital broadcast terminal, a message transmission device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0130] Referring to Figure 4 , the electronic device 800 can include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.

[0131] The processing component 802 generally controls the overall operations of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 can include one or more processors 820 to execute instructions to complete the steps of the methods described above, in whole or in part. Moreover, the processing component 802 can include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0132] The memory 804 is configured to store various types of data to support the operations of the electronic device 800. Examples of these data include instructions to operate any applications or methods on the electronic device 800, contact data, phonebook data, messages, images, videos, and the like. The memory 804 can be realized by any type of volatile or non-volatile memory devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disc, or optical disc.

[0133] The power component 806 provides power to the various components of the electronic device 800. The power component 806 can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the electronic device 800.

[0134] The multimedia component 808 includes a screen to provide an output interface between the electronic device 800 and a user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes the touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a slide, and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touching or sliding action, but also detect duration and pressure related to the touching or sliding action. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. The front camera and / or the rear camera can receive external multimedia data when the device 800 is in an operating mode, such as a shooting mode or a video mode. Each of the front camera and the rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0135] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC) that is configured to receive an external audio signal when the electronic device 800 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0136] The I / O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which can be a keypad, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button, and a lock button.

[0137] The sensor component 814 includes one or more sensors for providing status assessments of various aspects of the electronic device 800. For example, the sensor component 814 can detect an open / closed position of the device 800, relative positioning of components, such as a display and a keypad of the electronic device 800, a change of position of the electronic device 800 or a component of the electronic device 800, presence or absence of user contact with the electronic device 800, orientation or acceleration / deceleration of the electronic device 800, and temperature changes of the electronic device 800. The sensor component 814 can include an orientation sensor, an acceleration sensor, a proximity sensor, a gesture sensor, a biometric sensor, a temperature / humidity sensor, an illumination sensor, and / or an interaction sensor. The sensor component 814 can further include an electronic component, for example, a camera, a microphone, and / or a user input interface, to measure a physical quantity or to generate a user interface.

[0138] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a operator network, such as 2G, 3G, 4G, or 5G, or a combination thereof. In an example embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component 816 further includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technology.

[0139] In exemplary embodiments, the electronic device 800 can be implemented with one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, micro-controllers, microprocessors or other electronic elements, for performing the above-described methods.

[0140] In exemplary embodiments, a non-transitory computer-readable storage medium including instructions, such as the memory 804 including instructions, is also provided, which can be executed by the processor 820 of the electronic device 800 to accomplish the above-described methods. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0141] Figure 5 is a block diagram of a computer-readable storage medium 1900 according to an exemplary embodiment of the present application. For example, the computer-readable storage medium 1900 can be provided as a server.

[0142] Referring to Figure 5 , the computer-readable storage medium 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application program, executable by the processing component 1922. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described methods.

[0143] The computer-readable storage medium 1900 can further include a power supply component 1926 configured to perform power management of the computer-readable storage medium 1900, a wired or wireless network interface 1950 configured to connect the computer-readable storage medium 1900 to a network, and an input / output (I / O) interface 1958. The computer-readable storage medium 1900 can operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0144] It should be noted that, in the present document, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0145] Those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the methods described in various embodiments of the present application.

[0146] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative, not restrictive, and those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the scope of protection of the claims.

[0147] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the embodiments of the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solutions. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0149] In the embodiments of the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described embodiments of the apparatus are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0150] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0151] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically independent unit, or two or more units can be integrated into a unit.

[0152] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, and various program codes that can be stored in the medium.

[0153] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for implementing segmented routing by extending the WireGuard protocol, characterized in that, The method includes: The management plane sends routing information to the access point and the relay point respectively, and inserts the route of the first relay point into the access point; When the first relay point receives the routing information, it forwards the preset WireGuard protocol packet to the second relay point; The second relay point forwards the routing information to the destination access point according to the preset WireGuard protocol packet; The access point sends a request and forwards it to the destination access point according to the route planned by the preset WireGuard protocol packet; The access point is a standard WireGuard node; The relay point is a WireGuard node that extends the WireGuard protocol; The WireGuard protocol can be extended by modifying its source code and adding a relay mode.

2. The method as described in claim 1, characterized in that, The method further includes: The access point also includes the communication entry point endpoint for the proxy access service. When the management plane sends routing information to the access point, the routing information includes the IP address of the access point and the IP address of the endpoint.

3. The method as described in claim 2, characterized in that, The method further includes: When the management plane sends routing information to the access point and the relay point respectively, the routing information is forwarded through the first relay point.

4. The method as described in claim 1, characterized in that, The method further includes: Establish a segmented routing system by extending the WireGuard protocol, and deploy a preset number of relay points for the system; The system includes a centralized management plane system and a distributed control plane center.

5. The method as described in claim 4, characterized in that, The method further includes: The data format for the access point distributed by the management plane includes the first peer public key, the public endpoint of the first peer node, and the IP address of the first security group node; The data format for the control plane to be distributed from the management plane includes the second peer's public key, the public endpoint of the second peer node, latency, bandwidth, packet loss rate, and service level agreement (SLA). The data format for the control plane to send to the relay node includes the third peer's public key, the public endpoint of the third peer node, and the IP address of the next security group node.

6. An apparatus for implementing segmented routing by extending the WireGuard protocol, characterized in that, The device includes: The management plane distribution module is used to distribute routing information from the management plane to the access point and the relay point respectively, and to insert the route of the first relay point into the access point; The first forwarding module is used to forward a preset Wireguard protocol packet to the second relay point when the first relay point receives routing information; The second forwarding module is used by the second relay point to forward the routing information to the destination access point according to the preset Wireguard protocol packet; The global forwarding module is used to forward requests issued by the access point to the destination access point according to the route planned by the preset Wireguard protocol packet. The access point is a standard WireGuard node; The relay point is a WireGuard node that extends the WireGuard protocol; The WireGuard protocol can be extended by modifying its source code and adding a relay mode.

7. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images