Switch MAC address and VLAN management method and device, equipment and storage medium

Abstract

The invention discloses a switch MAC address and VLAN management method and device, equipment and a storage medium, and relates to the technical field of network communication, and the method comprises the steps: obtaining an access control list rule and a source MAC address in a data packet; performing rule matching on the source MAC address based on the access control list rule to generate a matching result; determining a target VLAN identifier of the data packet according to the matching result; and performing VLAN access control according to the target VLAN identifier, thereby simplifying network management, and improving network security and flexibility.

Description

Technical Field

[0001] The present application relates to the technical field of network communications, and in particular to a switch MAC address and VLAN management method, apparatus, device, and storage medium. Background Art

[0002] In the field of network communications, switches, as core devices, undertake the important tasks of packet forwarding and network isolation.

[0003] At present, virtual LAN functions based on MAC (Media Access Control Address) usually rely on static configuration or protocol-based methods to allocate and manage the binding of MAC addresses and VLANs (Virtual Local Area Networks). However, this method has significant defects. First, static configuration requires network administrators to manually set the mapping relationship between MAC and VLAN, which is not only prone to errors, but also has extremely high configuration and maintenance costs in large-scale networks. Secondly, traditional methods lack flexibility and cannot dynamically adjust the binding relationship between MAC addresses and VLANs according to actual traffic, which limits the network's adaptability. In addition, existing MAC address and VLAN binding methods often lack fine-grained security policy control, which may allow illegal devices to access the network and threaten network security.

[0004] Therefore, as the scale and complexity of networks expand, how to efficiently, flexibly and securely manage the binding relationship between the switch's MAC address and VLAN has become an urgent problem that needs to be solved. Summary of the Invention

[0005] The main purpose of this application is to provide a switch MAC address and VLAN management method, device, equipment and storage medium, aiming to solve the technical problem of how to efficiently, flexibly and securely manage the binding relationship between the switch MAC address and VLAN.

[0006] To achieve the above objectives, the present application proposes a switch MAC address and VLAN management method, the method comprising:

[0007] Get access control list rules and source MAC addresses in data packets;

[0008] Perform rule matching on the source MAC address based on the access control list rule to generate a matching result;

[0009] Determine the target VLAN identifier of the data packet according to the matching result;

[0010] VLAN access control is performed according to the target VLAN identifier.

[0011] In one embodiment, the step of obtaining access control list rules includes:

[0012] Get rule priority, device type matching conditions, traffic type matching conditions, and time type matching conditions;

[0013] An access control list rule is obtained according to the rule priority, the device type matching condition, the traffic type matching condition, and the time type matching condition.

[0014] In one embodiment, the step of obtaining the access control list rule according to the rule priority, the device type matching condition, the traffic type matching condition, and the time type matching condition includes:

[0015] Sorting the device type matching condition, the traffic type matching condition, and the time type matching condition according to the rule priority to generate a sorted priority rule set;

[0016] Obtaining device type matching logic according to the device type matching condition;

[0017] Obtaining filtering parameters according to the traffic type matching condition, wherein the filtering parameters include a protocol type and a bandwidth threshold;

[0018] Obtain the effective time corresponding to different rules according to the time type matching condition;

[0019] An access control list rule is generated based on the priority rule set, the device type matching logic, the filtering parameter, and the effective time.

[0020] In one embodiment, the step of performing rule matching on the source MAC address based on the access control list rule to generate a matching result includes:

[0021] Obtaining the current time, device type, and traffic type in the data packet;

[0022] Parsing the access control list rule to obtain matching elements, the matching elements including source MAC address range, priority identifier, effective time, device type range, and traffic type range;

[0023] Sort the access control list rules based on the priority identifier to generate a priority sorting queue;

[0024] The source MAC address, the current time, the device type, and the traffic type are matched according to the priority sorting queue and the matching elements to obtain a matching result.

[0025] In one embodiment, the step of matching the source MAC address, the current time, the device type, and the traffic type according to the priority sorting queue and the matching elements to obtain a matching result includes:

[0026] Traversing each rule in descending order of the priority sorting queue, and performing matching judgment on the traversed rules;

[0027] If any one of the following conditions is met: the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule, the match result is determined to be a successful match, and the traversal is terminated at the same time;

[0028] If the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule, and none of the conditions are met, and no rule meets the matching conditions after the traversal is completed, the matching result is determined to be a matching failure.

[0029] In one embodiment, the step of determining the target VLAN identifier of the data packet according to the matching result includes:

[0030] When the matching result is a successful match, obtaining the successfully matched target rule, and extracting the VLAN identifier bound in the target rule as the target VLAN identifier;

[0031] When the matching result is a matching failure, a preset default VLAN identifier or an upper-layer configuration policy is obtained, and a target VLAN identifier is determined according to the default VLAN identifier or the upper-layer configuration policy.

[0032] In one embodiment, the step of performing VLAN access control according to the target VLAN identifier includes:

[0033] Obtaining the destination MAC address in the data packet;

[0034] When the target MAC address matches the target VLAN identifier, forwarding the data packet to the target VLAN according to the target VLAN identifier;

[0035] When the target MAC address does not match the target VLAN identifier, transmission of the data packet is prohibited and a security alarm log is generated.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a switch MAC address and VLAN management device, the device comprising:

[0037] Data extraction module, used to obtain access control list rules and source MAC addresses in data packets;

[0038] A rule matching module, configured to perform rule matching on the source MAC address based on the access control list rule to generate a matching result;

[0039] A VLAN assignment module, configured to determine a target VLAN identifier of the data packet according to the matching result;

[0040] The access control module is used to perform VLAN access control according to the target VLAN identifier.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a switch MAC address and VLAN management device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the switch MAC address and VLAN management method as described above.

[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and stores a computer program on the storage medium. When the computer program is executed by the processor, the steps of the switch MAC address and VLAN management method as described above are implemented.

[0043] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the switch MAC address and VLAN management method as described above.

[0044] This application provides a switch MAC address and VLAN management method, which includes: obtaining access control list rules and the source MAC address in a data packet; performing rule matching on the source MAC address based on the access control list rules to generate a matching result; determining the target VLAN ID of the data packet based on the matching result; and performing VLAN access control based on the target VLAN ID. In summary, this application simplifies network management and improves network security and flexibility through the steps of access control list configuration, MAC address learning, VLAN allocation, and access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A flowchart of the first embodiment of the switch MAC address and VLAN management method provided in this application;

[0048] Figure 2 A flowchart of the second embodiment of the switch MAC address and VLAN management method provided in this application;

[0049] Figure 3 A flowchart of the third embodiment of the switch MAC address and VLAN management method provided in this application;

[0050] Figure 4 This is a schematic diagram of the module structure of the switch MAC address and VLAN management device according to an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the switch MAC address and VLAN management method in the embodiment of the present application.

[0052] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] The main solution of the embodiment of the present application is: obtaining the access control list rules and the source MAC address in the data packet; performing rule matching on the source MAC address based on the access control list rules to generate a matching result; determining the target VLAN ID of the data packet based on the matching result; and performing VLAN access control based on the target VLAN ID.

[0056] In the field of network communications, switches, as core devices, undertake the important tasks of packet forwarding and network isolation.

[0057] Currently, virtual local area network (VLAN) functions based on MAC (Media Access Control Address) usually rely on static configuration or protocol-based methods to allocate and manage the binding of MAC addresses and VLANs. However, this method has significant drawbacks. First, static configuration requires network administrators to manually set the mapping relationship between MAC and VLAN, which is not only prone to errors, but also has extremely high configuration and maintenance costs in large-scale networks. Second, traditional methods lack flexibility and cannot dynamically adjust the binding relationship between MAC addresses and VLANs based on actual traffic, which limits the network's adaptability. In addition, existing MAC address and VLAN binding methods often lack fine-grained security policy control, which may allow illegal devices to access the network and threaten network security. Therefore, as the scale of networks expands and the complexity increases, how to efficiently, flexibly and securely manage the binding relationship between the switch's MAC address and VLAN is a problem that urgently needs to be solved.

[0058] This application simplifies network management and improves network security and flexibility through steps such as access control list configuration, MAC address learning, VLAN allocation and access control.

[0059] It should be noted that the execution entity of this embodiment can be a switch MAC address and VLAN management system, a computing service device with data processing, network communication, and program execution functions, or an electronic device capable of implementing the above-mentioned switch MAC address and VLAN management functions, etc. This embodiment is not specifically limited to these. The following uses the switch MAC address and VLAN management system as an example to illustrate this embodiment and the following embodiments.

[0060] Based on this, the embodiment of the present application provides a switch MAC address and VLAN management method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the switch MAC address and VLAN management method of the present application.

[0061] In this embodiment, the switch MAC address and VLAN management method includes steps S10 to S40:

[0062] Step S10: Obtain the access control list rules and the source MAC address in the data packet.

[0063] It's important to note that in this step, upon receiving a packet, the system first parses the packet to obtain its source MAC address. Simultaneously, the system retrieves the configured access control list (ACL) rules from its internal storage. These rules are predefined by the network administrator through the system's configuration interface or command-line interface and include key information such as the source MAC address, VLAN ID, priority, and type.

[0064] Additionally, it's important to note that the source MAC address refers to the MAC address of the packet sender, uniquely identifying the sending device on the network. Access control list rules are a set of rules configured on a switch that define which MAC address ranges should be assigned to which VLANs, along with the priority and other parameters of these assignments.

[0065] Step S20: performing rule matching on the source MAC address based on the access control list rule to generate a matching result.

[0066] It should be noted that in this step, the system matches the acquired source MAC address against the retrieved ACL rules one by one. The matching process considers factors such as the rule's priority, type (such as device type matching, traffic type matching, time type matching), and effective time. If the source MAC address fully matches an ACL rule (including conditions such as MAC address range, priority, type, and time), a successful match is generated; otherwise, a failed match is generated.

[0067] Additionally, it should be noted that the matching result refers to the result after the source MAC address matches the ACL rule, including a successful match (a matching rule is found) and a failed match (no matching rule is found).

[0068] Step S30: Determine the target VLAN ID of the data packet according to the matching result.

[0069] It's important to note that the destination VLAN ID is the unique identifier of the VLAN to which the packet should be assigned. It's key information the switch uses to distinguish between different VLANs. In this step, the system determines the packet's destination VLAN ID based on the matching results. Specifically, the VLAN ID in the matching ACL rule is used as the destination VLAN ID.

[0070] As you can understand, this step is to clearly identify the VLAN to which the packet should be assigned, thereby effectively isolating and managing network traffic. By determining the target VLAN ID, the switch can ensure that the packet is forwarded within the correct VLAN, preventing illegal devices or traffic from accessing other VLANs.

[0071] In a feasible implementation manner, the step S30 specifically includes:

[0072] Step S301: When the matching result is a successful match, the successfully matched target rule is obtained, and the VLAN identifier bound to the target rule is extracted as the target VLAN identifier.

[0073] It's important to note that when the system successfully matches a source MAC address against an ACL rule, the switch immediately locates the specific ACL rule that matched the packet, known as the target rule. This target rule contains the pre-defined source MAC address or MAC address range, along with the VLAN ID associated with it. The switch extracts the VLAN ID from the target rule and uses it as the target VLAN ID for the packet.

[0074] In addition, it should be noted that the target rule refers to the specific rule in the ACL rule set that successfully matches the source MAC address. The rule includes the source MAC address or MAC address range and the VLAN ID bound to it.

[0075] Step S302: When the matching result is a matching failure, a preset default VLAN identifier or an upper-layer configuration policy is obtained, and a target VLAN identifier is determined according to the default VLAN identifier or the upper-layer configuration policy.

[0076] It should be noted that when the system completes the matching of the source MAC address and the ACL rule, but the matching result fails, the system will adopt another strategy to determine the target VLAN ID of the data packet. Specifically, the system will first check whether a default VLAN ID is preset. If a default VLAN ID is preset, it will be directly used as the target VLAN ID. If there is no default VLAN ID preset, the switch will further check whether there is an upper-level configuration policy. The upper-level configuration policy refers to the policy or rule that is higher than the current switch configuration level in the network. The upper-level configuration is set by the network administrator or network management system to guide the VLAN allocation behavior of the switch. The policy is formulated based on multiple factors such as network topology, device type, security requirements, etc. Based on the upper-level configuration policy, the switch will determine a corresponding target VLAN ID.

[0077] It is understood that the purpose of this step is to provide a backup VLAN assignment solution when the source MAC address of a packet does not match the ACL rule, ensuring that the packet can still be correctly forwarded to a specific VLAN. By presetting default VLAN identifiers or upper-layer configuration policies, the switch enhances the robustness and flexibility of the network and ensures the normal forwarding of network traffic even when the ACL rule configuration is incomplete or incorrect.

[0078] Step S40: Perform VLAN access control according to the target VLAN identifier.

[0079] It should be noted that in this step, the system performs VLAN access control on the packet based on the determined destination VLAN ID. This includes checking whether the packet's destination MAC address matches the configured VLAN and determining whether to allow cross-VLAN communication based on ACL rules. If the packet's destination VLAN does not match the configured VLAN, or if cross-VLAN communication does not comply with ACL rules, the packet will be dropped or forwarding will be restricted.

[0080] Furthermore, it's important to note that as the network topology changes (such as when a device moves or changes its IP address), the MAC address-to-VLAN binding relationship can also change. The dynamic update module automatically detects network changes and updates ACL rules and VLAN bindings as needed. Specifically, the system periodically scans the network status or detects device changes based on events. If a device joins a new VLAN or its IP address changes, the system automatically updates the ACL rules to adjust the MAC-to-VLAN binding relationship.

[0081] It can be understood that VLAN access control is a process of restricting and managing the forwarding behavior of data packets in the network based on the target VLAN ID, aiming to ensure the security and compliance of the network.

[0082] In a feasible implementation manner, the step S40 specifically includes:

[0083] Step S401: Obtain the target MAC address in the data packet.

[0084] It's important to note that when the system receives a data packet, it first parses the packet's header to extract the destination MAC address. The destination MAC address is the physical address of the device to which the packet is intended, and the system uses this address to determine the packet's forwarding path. It can be understood that this refers to the physical address of the device specified in the packet's header. In an Ethernet environment, each network device has a unique MAC address, which is used for communication within the local area network.

[0085] Step S402: When the target MAC address matches the target VLAN identifier, forward the data packet to the target VLAN according to the target VLAN identifier.

[0086] It should be noted that after obtaining the destination MAC address and destination VLAN ID of a data packet, the system will check whether the destination MAC address belongs to the VLAN corresponding to the destination VLAN ID. If a match is successful, that is, the destination MAC address does exist in the destination VLAN, the system will forward the data packet to the corresponding port in the VLAN based on the destination VLAN ID, thereby ensuring the correct transmission of the data packet.

[0087] Step S403: When the target MAC address does not match the target VLAN identifier, transmission of the data packet is prohibited and a security alarm log is generated.

[0088] It should be noted that if the switch detects a mismatch between the destination MAC address and the destination VLAN ID during the packet check, meaning that the destination MAC address does not belong to the destination VLAN, the switch will prohibit the packet from being transmitted and generate a corresponding security alert log. The security alert log will record relevant information about the packet, such as the source MAC address, destination MAC address, destination VLAN ID, and the time the transmission was prohibited, so that network administrators can conduct subsequent analysis and processing.

[0089] It is understandable that the purpose of this step is to prevent illegal devices or traffic from accessing across VLANs and improve network security.

[0090] This embodiment provides a switch MAC address and VLAN management method, comprising: obtaining access control list rules and a source MAC address from a data packet; performing rule matching on the source MAC address based on the access control list rules to generate a matching result; determining the target VLAN ID of the data packet based on the matching result; and performing VLAN access control based on the target VLAN ID. As can be seen, this embodiment simplifies network management and improves network security and flexibility through the steps of access control list configuration, MAC address learning, VLAN allocation, and access control.

[0091] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment 1 can be referred to the above introduction and will not be described in detail later. Figure 2 , Figure 2 This is a flow chart of the second embodiment of the switch MAC address and VLAN management method of this application. The steps of obtaining access control list rules specifically include:

[0092] Step A10: Obtain the rule priority, device type matching condition, traffic type matching condition, and time type matching condition.

[0093] It's important to note that in this step, the system first reads the access control list (ACL) configuration information from its configuration storage. During this process, the system considers four aspects of configuration information: rule priority, device type matching conditions, traffic type matching conditions, and time type matching conditions. Rule priority refers to the priority value for each rule extracted by the switch from the ACL configuration. These priority values ​​determine which rule will be applied first when multiple rules are matched simultaneously. A lower priority value indicates a higher priority. Device type matching conditions refer to the switch parsing the ACL configuration and identifying conditions for matching device types, such as MAC address prefixes and vendor information. These conditions are used to determine whether a packet originates from a specific device type. Traffic type matching conditions refer to the switch extracting traffic type matching conditions from the ACL, such as protocol type and port number. These conditions are used to identify the traffic characteristics of the packet. Time type matching conditions refer to the switch reading time-related conditions from the ACL configuration, such as the specific time period during which the rule is effective. These conditions control the applicability of the rule during different time periods.

[0094] Step A20: Obtaining access control list rules according to the rule priority, the device type matching condition, the traffic type matching condition, and the time type matching condition.

[0095] It should be noted that in this step, the system will construct a complete ACL rule based on the obtained matching conditions and priority values. Specifically, the switch combines the matching conditions and priority values ​​of each rule into a structured rule entry and stores it in the ACL rule base. These rule entries will be used for subsequent packet matching and processing. It can be understood that the purpose of this step is to combine the matching conditions and priority values ​​into a structured rule entry to guide the switch's packet processing. These rule entries include fields such as source MAC address, destination MAC address, protocol type, port number, priority, and corresponding processing actions (such as allow, deny, forward, etc.). The ACL rule base refers to the database or data structure inside the switch used to store ACL rules. When processing a packet, the switch will query the rule entries in the ACL rule base to determine how to process the packet.

[0096] In a feasible implementation manner, the step A20 specifically includes:

[0097] Step A201: Sort the device type matching condition, traffic type matching condition, and time type matching condition according to the rule priority to generate a sorted priority rule set.

[0098] It's important to note that during this step, the system reads the rule priority information from the configuration and then sorts the device type, traffic type, and time type matching conditions based on these priority values. Sorting is based on the priority value, with lower values ​​indicating higher priority. After sorting, a rule set is generated, arranged in descending order of priority. This step ensures that when processing packets, the switch applies rules according to the predefined priority order, ensuring that critical traffic and devices receive priority.

[0099] Step A202: Obtain device type matching logic according to the device type matching condition.

[0100] It's important to note that device type matching logic refers to the logical statements or conditional combinations used to determine whether a packet originates from a specific type of device. Specifically, in this step, the system extracts device type matching conditions from the ACL configuration, such as the MAC address prefix and vendor identifier, and constructs the device type matching logic based on these conditions. The matching logic includes conditional statements used to determine whether a packet originates from a specific type of device.

[0101] Step A203: Obtain filtering parameters according to the traffic type matching condition, where the filtering parameters include a protocol type and a bandwidth threshold.

[0102] It's important to note that in this step, the system extracts traffic type matching criteria, such as protocol type and port number, from the ACL configuration and determines filtering parameters based on these criteria. Filtering parameters, including protocol type and bandwidth threshold, are used to restrict or allow specific types of traffic. Protocol type refers to the communication protocol used for packet transmission, such as TCP, UDP, and HTTPS. Bandwidth thresholds are the upper limit on the bandwidth allowed for traffic, used to control network congestion and ensure bandwidth requirements for critical applications.

[0103] It is understandable that the purpose of this step is to enable the switch to implement refined traffic control strategies based on traffic types, thereby ensuring the rational allocation and efficient use of network resources.

[0104] Step A204: Obtain the effective time corresponding to different rules according to the time type matching condition.

[0105] It's important to note that the effective time refers to the specific time or time period when an ACL rule begins and ends. In this step, the system reads the time type matching conditions from the ACL configuration, including the specific time periods during which the rule is effective, such as weekdays and holidays. The system then determines the effective time corresponding to each rule based on the time type matching conditions, ensuring that the rule is applied during the correct time period.

[0106] It is understandable that the purpose of this step is to enable the switch to flexibly adjust the application of rules according to time factors to achieve more refined traffic management.

[0107] Step A205: Generate access control list rules based on the priority rule set, the device type matching logic, the filtering parameters, and the effective time.

[0108] It's important to note that in this step, the system constructs a complete ACL rule based on the generated priority rule set, device type matching logic, filtering parameters, and effective time. These rules will be used to instruct the switch on how to apply matching conditions, filtering parameters, and effective time when processing packets, thereby achieving refined traffic control and security management. For example, the system will construct a complete ACL rule based on the generated priority rule set (server traffic priority), device type matching logic (specific vendor servers), filtering parameters (HTTPS protocol, 10Mbps bandwidth threshold), and effective time (8:00 AM to 12:00 AM). This rule will instruct the switch to allow HTTPS traffic from a specific vendor's server to pass and give it high priority if the bandwidth does not exceed 10Mbps and is within the effective time.

[0109] Step A30: Obtain the source MAC address in the data packet.

[0110] It can be understood that this step is a split of step S10. For the same or similar content as that in step S10, please refer to the above introduction and will not be repeated here.

[0111] In this embodiment, matching conditions are sorted by rule priority and an ACL rule set is constructed. Specific ACL rules are generated in combination with device type, traffic type, and time type matching logic. This implements dynamic and refined control of MAC address and VLAN binding, solves the problems of traditional static configuration management, such as complexity, poor flexibility, and insufficient security, and improves the efficiency, flexibility, and security of network management.

[0112] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the first and second embodiments can be referred to above and will not be described in detail. Figure 3 , Figure 3 This is a flow chart of the third embodiment of the switch MAC address and VLAN management method of the present application, wherein step S20 specifically includes:

[0113] Step S201: Acquire the current time, device type, and traffic type in the data packet.

[0114] It should be noted that when the system receives a data packet, it will first parse the packet header information to extract the current time (obtained from the system clock), the device type (identified by the MAC address prefix, manufacturer identifier or predefined device type field) and the traffic type (such as TCP, UDP, HTTPS and other protocol types).

[0115] Additionally, it's important to note that the current time refers to the system time when the switch receives the packet, which is used to match the effective time in ACL rules. The device type refers to the type of device the packet originated from, such as a server, PC, or IP camera, identified by its MAC address or other identifier. The traffic type refers to the communication protocol used by the packet, such as TCP, UDP, or HTTPS, and is used to match the traffic type in ACL rules.

[0116] Step S202: parsing the access control list rules to obtain matching elements, wherein the matching elements include a source MAC address range, a priority identifier, an effective time, a device type range, and a traffic type range.

[0117] It should be noted that in this step, the system parses the matching elements of each rule from the stored ACL rules, including the source MAC address range, priority identifier, effective time, device type range, and traffic type range. The priority identifier indicates the execution priority of the ACL rule; the smaller the value, the higher the priority. The device type range refers to the device type or device type range specified in the ACL rule, which is used to match the device type in the data packet. The traffic type range refers to the traffic type range specified in the ACL rule, which is used to match the traffic type in the data packet.

[0118] Step S203: Sort the access control list rules based on the priority identifiers to generate a priority sorting queue.

[0119] It's important to note that in this step, the system sorts all rules based on their priority identifiers, creating a prioritized queue. Rules with higher priorities are placed at the front of the queue, ensuring they are applied first when a match is made. This sorting ensures that the highest-priority rules are applied first when processing packets, thus meeting the processing needs of critical traffic and devices.

[0120] Step S204: Match the source MAC address, the current time, the device type, and the traffic type according to the priority sorting queue and the matching elements to obtain a matching result.

[0121] It should be noted that in this step, the system sorts the queues by priority and sequentially matches the matching elements of each ACL rule (source MAC address range, effective time, device type range, and traffic type range) with the source MAC address, current time, device type, and traffic type in the packet. If a match is successful, a matching result is generated based on the matching ACL rule, including whether the packet is allowed to pass and the assigned target VLAN ID (i.e., VLAN ID).

[0122] In a feasible implementation manner, the step S204 specifically includes:

[0123] Step B10: traverse each rule in descending order of the priority sorting queue, and perform matching judgment on the traversed rules.

[0124] It should be noted that in this step, after obtaining the priority-sorted queues, the system will traverse each ACL rule in descending order (i.e., from highest priority to lowest priority). For each rule, the switch will perform a series of matching checks to determine whether the current packet meets the matching conditions of the rule.

[0125] Step B20: When any one of the following conditions is met: the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule, the matching result is determined to be a successful match, and the traversal is terminated.

[0126] It's important to note that when traversing each ACL rule, the system checks whether the current packet's source MAC address falls within the rule's source MAC address range, whether the current time falls within the rule's effective time, whether the packet's device type matches the rule's device type range, and whether the traffic type matches the rule's traffic type range. As long as any of these four conditions are met, the system determines that the current packet successfully matches the rule and immediately terminates the traversal process. For example, suppose the switch is traversing a top-priority ACL rule that requires the source MAC address to fall within a specific range and to be effective on weekdays. When the switch receives a packet from this MAC address range and the current time falls on a weekday, the switch determines that the match is successful and terminates the traversal.

[0127] Step B30: When the conditions that the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule are not met and no rule meets the matching conditions after the traversal is completed, the matching result is determined to be a matching failure.

[0128] It should be noted that if, after traversing all ACL rules, the switch finds that none of the rules' matching conditions are met (i.e., the source MAC address does not fall within the source MAC address range of any rule, the current time is not within the effective time of any rule, the device type of the packet does not match the device type range of any rule, and the traffic type does not match the traffic type range of any rule), the switch determines the match result as a match failure. For example, suppose a switch has three ACL rules, but the switch receives a packet whose source MAC address, current time, device type, and traffic type do not meet the matching conditions of any rule. After traversing all rules, the switch determines the match result as a match failure.

[0129] In this embodiment, the switch can automatically obtain information related to data packets and parse access control list rules, match and judge in sequence according to the priority sorting queue, and realize dynamic allocation of MAC address and VLAN binding based on traffic characteristics, solving the problems of complex, poor flexibility and insufficient security of traditional static configuration management, and improving the manageability, flexibility and security of the network.

[0130] This application also provides a switch MAC address and VLAN management device, please refer to Figure 4 , the switch MAC address and VLAN management device includes:

[0131] Data extraction module 10, used to obtain access control list rules and source MAC addresses in data packets;

[0132] A rule matching module 20 is configured to perform rule matching on the source MAC address based on the access control list rule to generate a matching result;

[0133] A VLAN assignment module 30 is configured to determine a target VLAN identifier of the data packet according to the matching result;

[0134] The access control module 40 is configured to perform VLAN access control according to the target VLAN identifier.

[0135] The switch MAC address and VLAN management device provided in this application, utilizing the switch MAC address and VLAN management method described in the aforementioned embodiments, can address the technical problem of efficiently, flexibly, and securely managing the binding relationship between a switch's MAC address and VLAN. Compared to the prior art, the switch MAC address and VLAN management device provided in this application achieves the same beneficial effects as the switch MAC address and VLAN management method described in the aforementioned embodiments. Other technical features of the switch MAC address and VLAN management device are the same as those disclosed in the aforementioned embodiments and are not further elaborated here.

[0136] In one embodiment, the data extraction module 10 is also used to obtain rule priority, device type matching conditions, traffic type matching conditions and time type matching conditions; and obtain access control list rules based on the rule priority, the device type matching conditions, the traffic type matching conditions and the time type matching conditions.

[0137] In one embodiment, the data extraction module 10 is further used to sort the device type matching conditions, traffic type matching conditions, and time type matching conditions according to the rule priority to generate a sorted priority rule set; obtain device type matching logic according to the device type matching conditions; obtain filtering parameters according to the traffic type matching conditions, the filtering parameters including protocol type and bandwidth threshold; obtain effective time corresponding to different rules according to the time type matching conditions; and generate access control list rules based on the priority rule set, the device type matching logic, the filtering parameters, and the effective time.

[0138] In one embodiment, the rule matching module 20 is further used to obtain the current time, device type and traffic type in the data packet; parse the access control list rules to obtain matching elements, the matching elements including the source MAC address range, priority identifier, effective time, device type range and traffic type range; sort the access control list rules based on the priority identifier to generate a priority sorting queue; match the source MAC address, the current time, the device type and the traffic type according to the priority sorting queue and the matching elements to obtain a matching result.

[0139] In one embodiment, the rule matching module 20 is further used to traverse each rule in descending order according to the priority sorting queue, and perform matching judgment on the traversed rules; when any one of the conditions that the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule is met, the matching result is determined to be a successful match, and the traversal is terminated at the same time; when the conditions that the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule are not met and no rule meets the matching condition after the traversal is completed, the matching result is determined to be a failed match.

[0140] In one embodiment, the VLAN assignment module 30 is further configured to, when the matching result is a successful match, obtain a target rule that has successfully matched, and extract the VLAN identifier bound to the target rule as the target VLAN identifier; when the matching result is a failed match, obtain a preset default VLAN identifier or an upper-layer configuration policy, and determine the target VLAN identifier based on the default VLAN identifier or the upper-layer configuration policy.

[0141] In one embodiment, the access control module 40 is further used to obtain the target MAC address in the data packet; when the target MAC address matches the target VLAN identifier, forward the data packet to the target VLAN according to the target VLAN identifier; when the target MAC address does not match the target VLAN identifier, prohibit the transmission of the data packet and generate a security alarm log.

[0142] The present application provides a switch MAC address and VLAN management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the switch MAC address and VLAN management method of the above-mentioned embodiment 1.

[0143] Reference below Figure 5 , which shows a schematic diagram of the structure of a switch MAC address and VLAN management device suitable for implementing the embodiments of the present application. The switch MAC address and VLAN management device in the embodiments of the present application can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The switch MAC address and VLAN management device shown are merely examples and should not limit the functions and scope of use of the embodiments of the present application.

[0144] like Figure 5As shown, the switch MAC address and VLAN management device may include a processing device 1001 (e.g., a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in ROM (Read Only Memory) 1002 or programs loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the switch MAC address and VLAN management device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 1006: input device 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output device 1008 including, for example, an LCD (Liquid Crystal Display), speaker, vibrator, etc.; storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and communication device 1009. Communication device 1009 may allow the switch MAC address and VLAN management device to communicate with other devices wirelessly or wired to exchange data. While the diagram illustrates a switch MAC address and VLAN management device with various systems, it should be understood that implementation or provision of all illustrated systems is not required. More or fewer systems may alternatively be implemented or provided.

[0145] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0146] The switch MAC address and VLAN management device provided in this application, utilizing the switch MAC address and VLAN management method described in the aforementioned embodiment, can address the technical problem of efficiently, flexibly, and securely managing the binding relationship between a switch's MAC address and VLAN. Compared to the prior art, the switch MAC address and VLAN management device provided in this application offers the same beneficial effects as the switch MAC address and VLAN management method described in the aforementioned embodiment. Other technical features of the switch MAC address and VLAN management device are the same as those disclosed in the aforementioned embodiment and are not further elaborated here.

[0147] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0148] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0149] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, the computer-readable program instructions being used to execute the switch MAC address and VLAN management method in the above-mentioned embodiment.

[0150] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable Read Only Memory or Flash memory), optical fiber, CD-ROM (CD-Read Only Memory, portable compact disk read-only memory), optical storage device, magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0151] The computer-readable storage medium may be included in the switch MAC address and VLAN management device; or may exist independently without being assembled into the switch MAC address and VLAN management device.

[0152] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the switch MAC address and VLAN management device, the switch MAC address and VLAN management device: obtains access control list rules and a source MAC address in a data packet; performs rule matching on the source MAC address based on the access control list rules to generate a matching result; determines a target VLAN identifier of the data packet based on the matching result; and performs VLAN access control based on the target VLAN identifier.

[0153] The computer program code for performing the operations of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer can be connected to the user's computer through any type of network, including a LAN (Local Area Network) or a WAN (Wide Area Network), or can be connected to an external computer (e.g., using an Internet service provider to connect via the Internet).

[0154] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0155] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0156] The computer-readable storage medium provided in this application stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned switch MAC address and VLAN management method. This computer-readable storage medium solves the technical problem of efficiently, flexibly, and securely managing the binding relationship between a switch's MAC address and VLAN. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the switch MAC address and VLAN management method provided in the aforementioned embodiment, and are not further elaborated here.

[0157] The present application also provides a computer program product, including a computer program, which implements the steps of the switch MAC address and VLAN management method as described above when the computer program is executed by a processor.

[0158] The computer program product provided in this application can solve the technical problem of efficiently, flexibly, and securely managing the binding relationship between a switch's MAC address and VLAN. Compared to the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the switch MAC address and VLAN management method provided in the above-mentioned embodiment, and will not be elaborated here.

[0159] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A switch MAC address and VLAN management method, characterized in that: The method comprises: Get access control list rules and source MAC addresses in data packets; Perform rule matching on the source MAC address based on the access control list rule to generate a matching result; Determine the target VLAN identifier of the data packet according to the matching result; VLAN access control is performed according to the target VLAN identifier.

2. The method according to claim 1, wherein The steps to obtain access control list rules include: Get rule priority, device type matching conditions, traffic type matching conditions, and time type matching conditions; An access control list rule is obtained according to the rule priority, the device type matching condition, the traffic type matching condition, and the time type matching condition.

3. The method according to claim 2, wherein The step of obtaining the access control list rule according to the rule priority, the device type matching condition, the traffic type matching condition, and the time type matching condition comprises: Sorting the device type matching condition, the traffic type matching condition, and the time type matching condition according to the rule priority to generate a sorted priority rule set; Obtaining device type matching logic according to the device type matching condition; Obtaining filtering parameters according to the traffic type matching condition, wherein the filtering parameters include a protocol type and a bandwidth threshold; Obtain the effective time corresponding to different rules according to the time type matching condition; An access control list rule is generated based on the priority rule set, the device type matching logic, the filtering parameter, and the effective time.

4. The method according to claim 1, wherein The step of performing rule matching on the source MAC address based on the access control list rule to generate a matching result includes: Obtaining the current time, device type, and traffic type in the data packet; Parsing the access control list rule to obtain matching elements, the matching elements including source MAC address range, priority identifier, effective time, device type range, and traffic type range; Sort the access control list rules based on the priority identifier to generate a priority sorting queue; The source MAC address, the current time, the device type, and the traffic type are matched according to the priority sorting queue and the matching elements to obtain a matching result.

5. The method according to claim 4, wherein The step of matching the source MAC address, the current time, the device type, and the traffic type according to the priority sorting queue and the matching elements to obtain a matching result includes: Traversing each rule in descending order of the priority sorting queue, and performing matching judgment on the traversed rules; If any one of the following conditions is met: the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule, the match result is determined to be a successful match, and the traversal is terminated at the same time; If the source MAC address belongs to the source MAC address range of the rule, the current time is within the effective time of the rule, the device type of the data packet matches the device type range of the rule, and the traffic type matches the traffic type range of the rule, and none of the conditions are met, and no rule meets the matching conditions after the traversal is completed, the matching result is determined to be a matching failure.

6. The method according to claim 1, wherein The step of determining the target VLAN identifier of the data packet according to the matching result comprises: When the matching result is a successful match, obtaining the successfully matched target rule, and extracting the VLAN identifier bound in the target rule as the target VLAN identifier; When the matching result is a matching failure, a preset default VLAN identifier or an upper-layer configuration policy is obtained, and a target VLAN identifier is determined according to the default VLAN identifier or the upper-layer configuration policy.

7. The method according to any one of claims 1 to 6, characterized in that The step of performing VLAN access control according to the target VLAN identifier comprises: Obtaining the destination MAC address in the data packet; When the target MAC address matches the target VLAN identifier, forwarding the data packet to the target VLAN according to the target VLAN identifier; When the target MAC address does not match the target VLAN identifier, transmission of the data packet is prohibited and a security alarm log is generated.

8. A switch MAC address and VLAN management device, characterized in that: The device comprises: Data extraction module, used to obtain access control list rules and source MAC addresses in data packets; A rule matching module, configured to perform rule matching on the source MAC address based on the access control list rule to generate a matching result; A VLAN assignment module, configured to determine a target VLAN identifier of the data packet according to the matching result; The access control module is used to perform VLAN access control according to the target VLAN identifier.

9. A switch MAC address and VLAN management device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the switch MAC address and VLAN management method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the switch MAC address and VLAN management method according to any one of claims 1 to 7 are implemented.

Images