A stateless lightweight cross-range network control method and system

Abstract

The present invention discloses a stateless lightweight cross-range network control method and system. The present invention realizes the configuration of cross-range network connection by adding a range gateway element in the topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario; when the cross-range scenario is started, each sub-range network is constructed and the unique ID of each element of the local topology is reported to the joint management center; the joint management center sends a triple data record containing the local and opposite cross-range port unique IDs and the opposite border gateway IP address to the border gateway of the sub-range; the border gateway generates a corresponding record locally based on the received triple data, and starts to listen at the designated port, encapsulating the intercepted message content and the opposite cross-range port unique ID together and sending it; the opposite range border gateway decapsulates and forwards it. The present invention can reduce the difficulty of implementing cross-range traffic intercommunication and improve the convenience of maintaining cross-range scenarios.

Description

Technical Field

[0001] The present invention relates to a stateless lightweight cross-range network control method and system, belonging to the technical field of network security. Background Art

[0002] In network range products, due to the limited equipment available at a single site, there's a need to consolidate multiple ranges into a single one. The core of this need lies in connecting the networks of each sub-range. Cross-range experimental scenarios typically establish a joint management center responsible for distributing and coordinating key network resources, such as IP addresses and network topology, across each range. Currently, cross-range network connectivity solutions primarily rely on VLAN and VXLAN technologies to connect the network, which presents the following issues: 1. VLAN technology requires that the networks between sub-ranges be connected at Layer 2; VXLAN is a virtual network, requiring that network equipment at each range have a virtual network controller. Physical networks across ranges generally span regions and are geographically distant. These two network solutions place high demands on the infrastructure between ranges. 2. Using a network technology stack to implement cross-range communication, each cross-range scenario involves a small network cutover. Due to the geographical distances between locations, any process problems are difficult and time-consuming to coordinate and troubleshoot. 3. VLAN and VXLAN are both general network technologies, without business information for each sub-range. The joint management center needs to build an additional layer of management data for the range and VLAN ID and a matching orchestration process, which makes development and joint debugging more difficult. 4. When building the network, the joint management center needs to adapt to the local network environment of each sub-range, such as virtual network controllers, switches, etc. The inconsistency of the network controller process protocols of each sub-range will increase the adaptation complexity of the joint management center. 5. If the basic network needs to be adjusted, when performing network cutover, all network devices involved in the cross-range network cutover need to have special configuration changes, which involves a large scope and can easily make the network unavailable after the cutover.

[0003] In summary, the JMC manages a diverse range of networks, and the methods for connecting them are complex. This requires waiting for and coordinating the network systems of each range to ensure dynamic network connectivity during scenario activation. Given the complex and ever-changing network requirements of each site, the JMC's process orchestration is also extremely complex. Therefore, there is an urgent need to introduce a stateless, lightweight network control solution to achieve network connectivity and effectively reduce the complexity of the JMC's processes. Summary of the Invention

[0004] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a stateless lightweight cross-range network control method and a cross-range network system to reduce the difficulty of implementing cross-range traffic intercommunication and improve the convenience of cross-range scenario maintenance.

[0005] Technical solution: To achieve the above-mentioned purpose, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a stateless lightweight cross-range network control method, comprising the following steps:

[0007] The cross-range network connection is configured by adding a range gateway element to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario;

[0008] When the cross-range scenario is started, each sub-range network will report the unique ID of each element of the local topology to the joint management center after the network is built;

[0009] The joint management center sends a triplet data record containing the local cross-range port unique ID, the peer cross-range port unique ID, and the peer border gateway IP address to the border gateway of the sub-range;

[0010] The border gateway generates a corresponding record locally based on the received triplet data, and starts listening on the designated port, encapsulating the intercepted message content with the peer end's cross-range port unique ID and sending it;

[0011] After receiving the encapsulated data, the border gateway of the opposite range decapsulates it, obtains the unique ID of the cross-range port, and forwards the message content to the corresponding port entity.

[0012] Preferably, the border gateway of each sub-range is an application deployed on any host machine of the virtual platform. The application forwards traffic between sub-ranges by starting sub-processes and opens and closes cross-range network connections by creating and destroying sub-processes.

[0013] Preferably, when the network of the scenario is being constructed, each sub-range starts a blank virtual machine instance under the configured cross-range connected network. The virtual machine instance is created on the host machine where the border gateway is located. When the virtual machine instance is started, its network card acts as the corresponding border gateway network card, and the network card acts as the local cross-range port. After the network construction is completed, each sub-range reports each element in the scenario topology to the joint management center, including the unique ID of the cross-range port.

[0014] Preferably, the border gateway finds the corresponding network card on the host machine according to the local cross-range port unique ID issued by the joint management center, starts a sub-process to monitor the traffic, and re-encapsulates the traffic before sending it out.

[0015] Furthermore, when the cross-range scenario is destroyed, the joint management center sends a destruction instruction to the border gateway containing the unique ID of the local cross-range port in the triplet. After receiving the destruction instruction, the border gateway stops the corresponding listening sub-process and deletes the corresponding triplet record.

[0016] Preferably, the border gateway encapsulates the message in a customized format, and directly encapsulates the communication information between the sub-ranges in the message. When encapsulating the second and third layer networks, the IP address of the peer border gateway is used for encapsulation. The fourth layer is a private cross-range protocol, including a network port identifier and a message segmentation identifier; the network port identifier is generated by converting the unique ID of the peer cross-range port; the message segmentation identifier is used to mark whether the message is segmented, the segmentation sequence and the segmentation ID.

[0017] As a preference, the message is segmented at most once, and whether the message is segmented occupies 1 bit in the message segmentation identifier, and the segmentation sequence occupies 1 bit.

[0018] In a second aspect, the present invention provides a cross-range network system, comprising at least two sub-ranges, each of which is deployed with a virtual platform; a joint management center, which is in communication with each sub-range and is used to coordinate cross-range network resources; the sub-ranges include border gateways; the joint management center stores a cross-range network topology, and configuration of cross-range network connections is achieved by adding range gateway elements to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario; when the cross-range scenario is started, the joint management center and the border gateway of the sub-range perform the following steps:

[0019] After the network construction of each sub-range is completed, the unique ID of each element of the local topology is reported to the joint management center;

[0020] The joint management center sends a triplet data record containing the local cross-range port unique ID, the peer cross-range port unique ID, and the peer border gateway IP address to the border gateway of the sub-range;

[0021] The border gateway generates a corresponding record locally based on the received triplet data, and starts listening on the designated port, encapsulating the intercepted message content with the peer end's cross-range port unique ID and sending it;

[0022] After receiving the encapsulated data, the border gateway of the opposite range decapsulates it, obtains the unique ID of the cross-range port, and forwards the message content to the corresponding port entity.

[0023] Furthermore, when the cross-range scenario is destroyed, the joint management center and the border gateway of the sub-range perform the following steps: the joint management center sends a destruction instruction to the border gateway containing the unique ID of the local cross-range port in the triplet. After receiving the destruction instruction, the border gateway stops the corresponding listening sub-process and deletes the corresponding triplet record.

[0024] As a preference, between sub-ranges that need to achieve cross-range network connections, only border gateways are required to communicate at the IP layer.

[0025] Beneficial effects: The present invention, through the configuration of the border gateway of the sub-target range, re-encapsulates the cross-target range traffic through the border gateway and then exchanges it point-to-point. There is no need to change the configuration of any network equipment in the original sub-target range, thereby reducing the cost of network deployment and maintenance. Compared with the existing technology, the present invention has the following advantages: 1. Only the three-layer intercommunication of the border gateway network is required between the sub-target ranges. The topology of the communication between the sub-target ranges is simple, the requirements for the basic network equipment are low, and the basic network does not need to be adjusted each time a scenario is created, which is easy to maintain. 2. The network traffic across the target range can be reversed by the management network or the signaling network. When the basic network is changed, there is no need to make network adjustments for the cross-target range traffic, which reduces the complexity of network deployment and cutover. 3. The network between each sub-target range relies on a standard procedure of the border gateway to forward traffic. There is no need to adapt various routers, switches or SDN devices for network orchestration, which reduces the adaptation workload. 4. When creating and destroying cross-target range scenarios, it is only necessary to synchronously create and delete the data in the border gateway. The border gateway does not perceive the topology and does not need to perceive the status of other devices, which reduces the complexity of the joint management center coordinating the networks of each sub-target range. 5. Cross-range processes can use private protocols for communication, and even if the traffic is captured, it cannot be parsed, which improves the security of the traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of cross-range network topology editing according to an embodiment of the present invention.

[0027] Figure 2 This is a schematic diagram of a cross-range scenario networking implementation according to an embodiment of the present invention.

[0028] Figure 3 Schematic diagram of border gateway message encapsulation according to an embodiment of the present invention.

[0029] Figure 4 This is another schematic diagram of cross-range network topology editing according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0031] The embodiment of the present invention discloses a stateless lightweight cross-range network control method, which realizes the configuration of cross-range network connection by adding range gateway elements to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario. When the cross-range scenario is started, after the construction of each sub-range network is completed, the unique ID of each element of the local topology is reported to the joint management center; the joint management center sends a triple data record containing the local cross-range port unique ID, the opposite cross-range port unique ID and the opposite border gateway IP address to the border gateway of the sub-range; the border gateway generates a corresponding record locally based on the received triple data, and starts to listen at the designated port, encapsulating the intercepted message content with the opposite cross-range port unique ID and sending it; the opposite range border gateway decapsulates the encapsulated data after receiving it, obtains the cross-range port unique ID therein, and forwards the message content to the corresponding port entity.

[0032] Specifically, the border gateway of each sub-range is an application deployed on any host machine of the virtual platform. The application forwards traffic between sub-ranges by starting sub-processes and opens and closes cross-range network connections by creating and destroying sub-processes.

[0033] The stateless, lightweight cross-range network control method described in an embodiment of the present invention relies solely on the border gateways of each sub-range to perform service data transfer. Each sub-range's border gateway operates independently, eliminating the need to record the status of other border gateways and obviating topology. Any party can perform a cutover or even a complete network destruction without notifying the sub-range gateways, thus reducing the requirements for the bearer network and simplifying the network construction process.

[0034] Figure 1 The diagram shows a cross-range network topology diagram of two sub-ranges. When building the network topology for the two sub-ranges, you need to drag the range gateway element to the network topology, configure which range and scene the range gateway leads to (for example, the range gateway of range 1-scene A leads to range 2-scene B), and each range gateway needs a point-to-point connection with the peer range gateway. Finally, use the connection line to mark which network the range gateway needs to connect to (the network directly connected to the border gateway). After the topology editing is completed, Figure 1 shown.

[0035] Figure 1 The networking implementation of the cross-range scenario shown is as follows Figure 2As shown. A border gateway is established at each sub-range. In this embodiment, the border gateway is a continuously running application deployed on any host machine in a virtual platform (such as an OpenStack cluster) to load any virtual network of the local range at any time. Each sub-range relies on the border gateway to exchange range service traffic. Layer 3 interoperability between the border gateways of each sub-range is sufficient. The joint management center needs to communicate directly with the border gateway to issue interoperability instructions.

[0036] The execution process after the scene is started includes the following steps:

[0037] In step S1, the network construction process creates all elements except the border gateway. The specific construction of each node and network in each sub-range scenario is based on existing technology and will not be further described. It is important to note that a network directly connected to the border gateway is created, and elements directly connected to the border gateway in the scenario topology (such as switches and routers) are added to this network.

[0038] Step S2: For each cross-range network connection, a border gateway listening network card needs to be created during the network construction process, which is recorded as the border gateway network card. The specific creation process is as follows: Taking openstack as an example, first create a cross-range port: openstack port create --network<gateway_net><gateway_port> After the creation is complete, a 36-bit gateway_port_uuid will be returned. Then, specify the host where the border gateway is located to create a blank virtual machine instance to start the network card: openstack server create --flavor m1.nano --image cirros --nicport-id=<gateway_port_uuid> --availability-zone nova:compute01 gateway_blank_vm. In the above command, gateway_net is the network directly connected to the border gateway generated when the network topology element was constructed in step S1, gateway_port is the network card provided to the range border gateway for listening, and gateway_port_uuid is the local cross-range port unique ID.

[0039] Step S3. After the completion of the above steps S1 and S2, each sub-range will report the information of each element in the range to the joint management center, including the 36-bit gateway_port_uuid created in the above step S2. The joint management center will identify the uuid as the cross-range port and start the process of opening up the network between the sub-ranges. Specifically, the joint management center will send the three metadata as a record to the border gateway of the sub-range. The specific triplet data is: local cross-range port uuid, peer cross-range port uuid, and peer border gateway IP address.

[0040] In step S4, the range border gateway receives the data sent by the joint management center and generates a corresponding record locally.

[0041] In step S5, the range border gateway obtains the network card named tap<the first 11 bits of the local cross-range port uuid> on its host machine, creates a child process to start listening to the traffic sent by the corresponding port of the network card, and encapsulates the intercepted message content and the cross-range port uuid of the other end and sends it out.

[0042] Step S6: The peer range border gateway decapsulates the encapsulated data after receiving it, obtains the cross-range port uuid and finds the corresponding port entity, and sends the message to be sent to the corresponding port entity.

[0043] The above steps S4 to S6 describe the network communication process in one direction, and the network communication process in the reverse direction is similar.

[0044] When the scene is destroyed, the joint management center sends a destruction instruction to the border gateway. The instruction only needs to include the local cross-range port uuid. After receiving the destruction instruction, the border gateway stops the listening sub-process of step S5 and deletes the record created in step S4.

[0045] Figure 3 The following diagram illustrates the border gateway encapsulation message format. When encapsulating Layer 2 and Layer 3 networks, the peer border gateway's IP address is used for encapsulation, and the protocol field value in the IP header is set to 200. Upon receiving a message with the IP header protocol value set to 200, the peer border gateway performs Layer 4 decapsulation using the following message format.

[0046] Layer 4 is a private protocol and is divided into two sections: a) The first section is the network port identifier: the 36-bit uuid of the peer cross-range port is converted into a 128-bit binary number. b) The second section is the message segmentation identifier: since the cross-range service data itself complies with the maximum transmission unit (MTU) constraint, re-encapsulation of the outer layer will cause the message length to exceed the MTU. The excess is only the data of layers 2, 3, and 4, so the message only needs to be segmented once. The message segmentation identifier is divided into three sections: a segmentation identifier of 0 indicates no segmentation and the data can be forwarded directly; a segmentation identifier of 1 indicates segmentation is required; identical segmentation IDs indicate the same message and need to be arranged and assembled according to the segmentation sequence.

[0047] Figure 4 The diagram shows a cross-range network topology diagram with three sub-ranges. The situation with three or more sub-ranges is similar to the situation with two sub-ranges mentioned above. The scenes in each range need to be dragged separately to the border gateway of the opposite range scene. For example, the cross-range network connection from Range 1-Scene A to Range 2-Scene B is configured through one range gateway element, and the cross-range network connection to Range 3-Scene C is configured through another range gateway element. When the scene is started, the creation process of each border gateway is independent, and each creation process is not aware of the topology. They independently configure the local border gateway according to the user's configuration, which reduces the difficulty of network construction and maintenance. Different range gateway elements in the same sub-range scene in the network topology diagram can share a border gateway application. Different cross-range network connections are implemented by creating different border gateway network cards and corresponding listening and forwarding sub-processes.

[0048] Based on the same inventive concept, an embodiment of the present invention further discloses a cross-range network system, comprising at least two sub-ranges, each of which is deployed with a virtual platform; a joint management center, which is in communication with each sub-range and is used to coordinate cross-range network resources; the sub-ranges include border gateways; the joint management center stores a cross-range network topology, and configuration of cross-range network connections is achieved by adding range gateway elements to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario; when the cross-range scenario is started, the joint management center and the border gateway of the sub-range perform the following steps:

[0049] After the network construction of each sub-range is completed, the unique ID of each element of the local topology is reported to the joint management center;

[0050] The joint management center sends a triplet data record containing the local cross-range port unique ID, the peer cross-range port unique ID, and the peer border gateway IP address to the border gateway of the sub-range;

[0051] The border gateway generates a corresponding record locally based on the received triplet data, and starts listening on the designated port, encapsulating the intercepted message content with the peer end's cross-range port unique ID and sending it;

[0052] After receiving the encapsulated data, the border gateway of the opposite range decapsulates it, obtains the unique ID of the cross-range port, and forwards the message content to the corresponding port entity.

[0053] When destroying the cross-range scenario, the joint management center and the border gateway of the sub-range perform the following steps: the joint management center sends a destruction instruction to the border gateway containing the unique ID of the local cross-range port in the triplet. After receiving the destruction instruction, the border gateway stops the corresponding listening sub-process and deletes the corresponding triplet record.

[0054] The cross-range network system in this embodiment requires that the sub-ranges connected across the cross-range network only need the border gateways to communicate with each other at the IP layer.

Claims

1. A stateless lightweight cross-range network control method, characterized in that: The steps include: The cross-range network connection is configured by adding a range gateway element to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario; When the cross-range scenario is started, each sub-range network will report the unique ID of each element of the local topology to the joint management center after the network is built; The joint management center sends a triplet data record containing the local cross-range port unique ID, the peer cross-range port unique ID, and the peer border gateway IP address to the border gateway of the sub-range; The border gateway generates a corresponding record locally based on the received triplet data, and starts listening on the designated port, encapsulating the intercepted message content with the peer end's cross-range port unique ID and sending it; After receiving the encapsulated data, the border gateway of the opposite range decapsulates it, obtains the unique ID of the cross-range port, and forwards the message content to the corresponding port entity.

2. A stateless lightweight cross-range network control method according to claim 1, characterized in that: The border gateway of each sub-range is an application deployed on any host machine of the virtual platform. This application forwards traffic between sub-ranges by starting sub-processes and opens and closes cross-range network connections by creating and destroying sub-processes.

3. A stateless lightweight cross-range network control method according to claim 2, characterized in that: When the network is being built, each sub-range starts a blank virtual machine instance under the configured cross-range connection network. The virtual machine instance is created on the host where the border gateway is located. When the virtual machine instance is started, its network card becomes the corresponding border gateway network card, and the network card will be used as the local cross-range port. After the network construction is completed, each sub-range will report each element in the scene topology to the joint management center, including the unique ID of the cross-range port.

4. A stateless lightweight cross-range network control method according to claim 1, characterized in that: The border gateway finds the corresponding network card on the host machine based on the local cross-range port unique ID issued by the joint management center, starts a sub-process to listen to the traffic, and re-encapsulates the traffic before sending it out.

5. A stateless lightweight cross-range network control method according to claim 1, characterized in that: When the cross-range scenario is destroyed, the joint management center sends a destruction instruction to the border gateway containing the unique ID of the local cross-range port in the triplet. After receiving the destruction instruction, the border gateway stops the corresponding listening sub-process and deletes the corresponding triplet record.

6. A stateless lightweight cross-range network control method according to claim 1, characterized in that: The border gateway encapsulates the message in a customized format, and directly encapsulates the communication information between the sub-ranges in the message. When encapsulating the second and third layer networks, the IP address of the border gateway on the other end is used for encapsulation. The fourth layer is a private cross-range protocol, including a network port identifier and a message segmentation identifier; the network port identifier is generated by converting the unique ID of the cross-range port on the other end; the message segmentation identifier is used to mark whether the message is segmented, the segmentation sequence and the segmentation ID.

7. A stateless lightweight cross-range network control method according to claim 6, characterized in that: The message is segmented at most once. The segmentation flag of the message occupies 1 bit to indicate whether the message is segmented and 1 bit to indicate the segmentation sequence.

8. A cross-range network system, comprising at least two sub-ranges, each of which is equipped with a virtual platform; a joint management center, in communication with each sub-range, for coordinating cross-range network resources; characterized in that: The sub-ranges include border gateways; the joint management center stores a cross-range network topology, and configuration of cross-range network connections is achieved by adding range gateway elements to the cross-range network topology, wherein a range gateway element is configured for each cross-range network connection in each sub-range scenario, and each range gateway element connects a cross-range port in the sub-range scenario and a range gateway element in the opposite sub-range scenario; when the cross-range scenario is started, the joint management center and the border gateway of the sub-range execute the following steps: After the network construction of each sub-range is completed, the unique ID of each element of the local topology is reported to the joint management center; The joint management center sends a triplet data record containing the local cross-range port unique ID, the peer cross-range port unique ID, and the peer border gateway IP address to the border gateway of the sub-range; The border gateway generates a corresponding record locally based on the received triplet data, and starts listening on the designated port, encapsulating the intercepted message content with the peer end's cross-range port unique ID and sending it; After receiving the encapsulated data, the border gateway of the opposite range decapsulates it, obtains the unique ID of the cross-range port, and forwards the message content to the corresponding port entity.

9. The cross-range network system according to claim 8, characterized in that: When the cross-range scenario is destroyed, the joint management center and the border gateway of the sub-range perform the following steps: the joint management center sends a destruction instruction to the border gateway containing the unique ID of the local cross-range port in the triplet. After receiving the destruction instruction, the border gateway stops the corresponding listening sub-process and deletes the corresponding triplet record.

10. The cross-range network system according to claim 8, characterized in that: For sub-ranges that need to achieve cross-range network connections, only border gateways are required to communicate at the IP layer.

Images