Data forwarding method and device, computer readable storage medium and electronic equipment

Abstract

The invention discloses a data forwarding method and device, a computer readable storage medium and electronic equipment. The method comprises the following steps: determining a first source interface and a first destination interface for forwarding target data in target equipment, the first source interface and the first destination interface respectively belonging to different sub-networks under the same network bridge; a first target mask value and a second target mask value are obtained, the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first target interface; determining that communication is allowed between the first source interface and the first destination interface based on the first target mask value and the second target mask value; and forwarding the target data from the first source interface to the first destination interface. According to the invention, the technical problems of increased network complexity, increased resource consumption and increased maintenance cost caused by multi-network bridge and DHCP server configuration in the current data forwarding technology are solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data forwarding method, device, computer-readable storage medium, and electronic device. Background Art

[0002] Mesh networking, also known as wireless mesh networking, is a wireless networking technology that connects multiple wireless network devices to create a wireless network environment with wider coverage and more stable signals. With continuous technological advancements, mesh networking has become an efficient solution for a variety of applications, including home and enterprise wireless access networks. Routers in mesh networks often include multiple subnetworks, such as a primary network and a guest network. To prevent interference between these subnetworks and ensure network security and effective access control, data isolation between subnetworks is crucial.

[0003] The conventional approach is to create a separate bridge for each subnet on the router and assign a specific 802.1Q VLAN ID (Virtual Local Area Network ID) to the networking interface. While this method can achieve data isolation, its implementation introduces several key issues. First, establishing multiple bridges and corresponding DHCP (Dynamic Host Configuration Protocol) servers significantly increases network complexity, leading to increased equipment and network maintenance costs. Second, because a physical interface can typically only belong to a specific bridge, external servers cannot simultaneously provide services to different subnets through a single interface. Furthermore, when multiple subnets share the same physical interface, relying solely on the forwarding database mechanism may cause data packets to be incorrectly isolated or intercepted due to the frequent changes in the MAC address of the front-end device in the forwarding database.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] Embodiments of the present invention provide a data forwarding method, apparatus, computer-readable storage medium, and electronic device to at least address the technical issues of increased network complexity, increased resource consumption, and increased maintenance costs caused by the configuration of multiple bridges and DHCP servers in current data forwarding technologies.

[0006] According to one aspect of an embodiment of the present invention, a data forwarding method is provided, including: determining a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; obtaining a first target mask value and a second target mask value, wherein the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first destination interface; based on the first target mask value and the second target mask value, determining that communication is allowed between the first source interface and the first destination interface; and forwarding the target data from the first source interface to the first destination interface.

[0007] Optionally, determining the first source interface for forwarding target data in the target device includes: obtaining a virtual local area network VLAN identifier included in the target data, wherein the VLAN identifier is set based on a subnetwork of a source of the target data, and a device corresponding to the subnetwork of a source of the target data is a source device different from the target device; based on the VLAN identifier, determining the first source interface from multiple interfaces in the target device.

[0008] Optionally, determine a second source interface for forwarding target data in the source device; determine an initial destination interface in the source device based on the MAC address of the target device; obtain a first interface identifier of the second source interface and a second interface identifier of the initial destination interface, wherein the first interface identifier is based on a subnet setting to which the second source interface belongs, and the second interface identifier is based on a subnet setting to which the initial destination interface belongs; determine a second destination interface for forwarding target data in the source device based on the first interface identifier and the second interface identifier, wherein the target data is transmitted from the second destination interface to the first source interface.

[0009] Optionally, the destination interface is determined based on the first interface identifier and the second interface identifier, including: when the first interface identifier and the second interface identifier match, determining the initial destination interface as the second destination interface; or, when the first interface identifier and the second interface identifier do not match, determining the second destination interface based on the first interface identifier.

[0010] Optionally, obtaining the first target mask value and the second target mask value includes: obtaining a first authority value of the subnet to which the first source interface belongs and a second authority value of the subnet to which the first destination interface belongs; determining a first initial mask value of the first source interface based on the first authority value; determining a second initial mask value of the first destination interface based on the second authority value; receiving a first authority request and a second authority request; adjusting the first initial mask value based on the first authority request to obtain a first target mask value; adjusting the second initial mask value based on the second authority request to obtain a second target mask value.

[0011] Optionally, based on the first target mask value and the second target mask value, determining whether communication is allowed between the first source interface and the first destination interface includes: performing a logical operation on the first target mask value and the second target mask value to obtain an operation result; based on the operation result and a preset threshold, determining whether communication is allowed between the first source interface and the first destination interface.

[0012] According to another aspect of the present invention, a data forwarding device is provided, including: a first determination module, used to determine the first source interface and the first destination interface for forwarding target data in the target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; an acquisition module, used to obtain a first target mask value and a second target mask value, wherein the first target mask value is the target mask value corresponding to the first source interface, and the second target mask value is the target mask value corresponding to the first destination interface; a second determination module, used to determine that communication is allowed between the first source interface and the first destination interface based on the first target mask value and the second target mask value; and a forwarding module, used to forward the target data from the first source interface to the first destination interface.

[0013] According to another aspect of the present invention, a computer-readable storage medium is provided, which includes a stored executable program, wherein when the executable program runs, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned data forwarding method.

[0014] According to another aspect of the present invention, an electronic device is provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned data forwarding method is executed when the program is running.

[0015] According to yet another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein the computer program implements the above-mentioned data forwarding method when executed by a processor.

[0016] In an embodiment of the present invention, a data forwarding method is adopted, by determining a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; obtaining a first target mask value and a second target mask value, wherein the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first destination interface; based on the first target mask value and the second target mask value, determining that communication is allowed between the first source interface and the first destination interface; forwarding the target data from the first source interface to the first destination interface, thereby achieving the purpose of data forwarding control between different subnetworks under the same bridge, thereby realizing the technical effect of improving the flexibility and security of data forwarding and reducing network load and complexity, and further solving the technical problems of increased network complexity, increased resource consumption and increased maintenance cost caused by multiple bridges and DHCP server configurations in current data forwarding technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0018] Figure 1 This is a schematic diagram of a network structure for implementing data isolation in a Mesh network based on existing technology;

[0019] Figure 2 is a flow chart of a data forwarding method according to an embodiment of the present invention;

[0020] Figure 3 is a schematic diagram of a structure of an optional sub-network between two devices according to an embodiment of the present invention;

[0021] Figure 4 is a schematic diagram of an optional master device sending data to a slave device according to an embodiment of the present invention;

[0022] Figure 5 is a schematic diagram of an optional slave device sending data to a master device according to an embodiment of the present invention;

[0023] Figure 6 is a schematic diagram of an optional slave device providing multiple sub-networks using the same networking interface according to an embodiment of the present invention;

[0024] Figure 7 This is a schematic diagram of an optional process of determining a destination interface by using an interface identifier according to an embodiment of the present invention;

[0025] Figure 81 is a schematic diagram of an optional process of implementing data isolation through forwarding control MASK according to an embodiment of the present invention;

[0026] Figure 9 is a structural block diagram of a data forwarding device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following interpretations:

[0030] Mesh network, also known as wireless mesh network, is a distributed network architecture composed of multiple wireless devices. Devices (nodes) are connected to each other wirelessly to form a mesh communication network.

[0031] A bridge is a network device used to connect two or more local area networks (LANs) of the same or similar network protocols, enabling them to communicate and exchange data as if they were a single network.

[0032] A MASK value, or mask value, is a technical parameter used to control or filter network traffic. In this embodiment, it refers to a digital identifier in any base that is used in advanced control of network devices (such as routers and switches) to determine whether a data packet should be forwarded or discarded.

[0033] An 802.1Q VLAN ID, also known as a virtual local area network identifier under the IEEE 802.1Q standard, is a value used to distinguish and mark an Ethernet frame as belonging to a specific VLAN (Virtual Local Area Network).

[0034] A DHCP server is a network service based on the DHCP (Dynamic Host Configuration Protocol), which is mainly used to automatically assign IP addresses and related network configuration information to devices within a local area network (LAN).

[0035] AP mode, short for Access Point mode, refers to a network device (usually a wireless router or wireless network adapter) acting as a wired or wireless access point, providing wireless local area network (WLAN) coverage and allowing wireless devices such as laptops, smartphones, and tablets to connect to a wired network or the Internet.

[0036] The FDB table, or Forwarding Database, is a database used by switches or network devices with switching functions (such as routers in bridge mode) to store MAC addresses and corresponding port mappings.

[0037] In a modern smart home environment, users may have multiple device connection requirements, including daily household devices, entertainment systems, smart security cameras, and guest devices. In enterprises, security and network management efficiency are crucial. IT departments need to ensure complete isolation between the intranet and guest networks while efficiently managing all network resources without affecting business continuity and employee experience. Traditional Mesh network solutions often achieve traffic isolation between subnets by creating multiple independent bridges. Figure 1 This is a schematic diagram of a network structure for implementing data isolation in a Mesh network based on existing technology. Figure 1 As shown, the steps of the above traditional method are as follows:

[0038] Step 1: Assign different 802.1Q VLAN IDs (such as VLAN 100 and VLAN 200) to different subnetworks (for example, the main network and the guest network).

[0039] Step 2: The router creates a separate bridge (e.g., br100, br200) for each subnet, ensuring that each bridge only handles traffic data for a specific subnet.

[0040] Step 3: The router creates corresponding virtual VLAN interfaces (for example, eth1.100 and eth1.200) for the networking interfaces and assigns them to the corresponding bridges.

[0041] Step 4: Each bridge needs to be configured with a DHCP server to provide IP addresses to user devices.

[0042] Although this method leverages the isolation characteristics of bridges to isolate data between different subnetworks, it requires the establishment of multiple bridges, each of which requires the configuration of a DHCP server. This not only increases network complexity but also increases router resource consumption and maintenance costs. Furthermore, since an interface can only belong to one bridge, in some scenarios, an external server cannot provide services to different subnetworks through a single interface. For example, when the router is in AP mode, an external server cannot provide Internet access to both the primary and guest networks simultaneously, requiring additional technical solutions.

[0043] Therefore, a technology is needed that does not affect network performance or increase hardware costs, while also simplifying management and improving security. Considering that bridges are the basis for connecting multiple network interfaces, mask values ​​are used to control packet forwarding at the bridge level, rather than the traditional method of creating multiple bridges. In addition, the use of 802.1Q VLAN IDs can be used to identify the subnet to which a packet belongs, and the network ID can further optimize subnet management and traffic isolation. Combining these two mechanisms with the FDB mechanism can achieve more efficient and flexible isolation and management of traffic from different subnets without changing the existing network infrastructure.

[0044] As an optional embodiment, the method of this embodiment can be performed by a router device, particularly a router with mesh networking capabilities. These routers are not only capable of handling complex network configurations but also implement secure and efficient data management between different subnetworks through innovative traffic isolation strategies. By flexibly utilizing strategies such as forwarding control masks, 802.1Q VLANs, and network IDs, the routers not only achieve effective traffic isolation between different subnetworks but also improve the network resource utilization efficiency and maintenance ease of the mesh network, providing a more secure, efficient, and cost-effective network isolation solution for homes, offices, and enterprises of all sizes.

[0045] According to an embodiment of the present invention, an embodiment of a data forwarding method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] Figure 2 FIG. 1 is a flow chart of a data forwarding method according to an embodiment of the present invention. Figure 2As shown, the method includes the following steps:

[0047] Step S201: Determine a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface belong to different subnetworks under the same bridge.

[0048] In this step, the target device may refer to a Mesh network router, and the target data may refer to a data packet transmitted in the network. The first source interface and the first destination interface respectively point to the starting point and the end point of the data packet when it is transmitted in the bridge. In a traditional Mesh network configuration, in order to achieve isolation between different sub-networks, it is usually necessary to create an independent bridge for each sub-network, which increases the complexity and resource consumption of the network. However, in this embodiment, traffic isolation between sub-networks can be achieved under the same bridge, which requires fine control of the properties of the first source interface and the first destination interface. When the router enters the forwarding decision stage, it can check which interface (the first source interface) the data packet is planned to be sent from and which interface (the first destination interface) it is planned to arrive at, and both interfaces are located under the same bridge, thereby achieving the determination of the first source interface and the first destination interface.

[0049] Step S202: Acquire a first target mask value and a second target mask value, wherein the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first destination interface.

[0050] In this step, the destination mask (MASK) value is a binary number configured for a router interface, used to control data transmission between that interface and other interfaces. In this embodiment, the MASK value is not limited to a simple binary bit mask; instead, it can be configured for different subnets, allowing the router to determine whether a packet should be forwarded to a specific interface based on the interface's MASK value. For example, decimal numbers can be used as the basis for the MASK value, which can be directly mapped to the subnet type or functional level, making it easier to understand and configure. Hexadecimal MASK values ​​can also be used for larger network environments, providing greater flexibility and more control options. This is particularly suitable for the network architecture of large enterprises or organizations, where different subnets have different security levels and access requirements. Using hexadecimal MASK values ​​allows for easier management and adjustment of communication permissions between these subnets. When a packet is transmitted in a mesh network, the router first identifies the packet's source and destination interfaces. Next, the router retrieves the MASK values ​​for the source and destination interfaces from a preconfigured interface list, thereby obtaining the first and second destination mask values. After obtaining the MASK value, the router's forwarding logic module will perform a logical operation on the two values. The result of the operation determines whether the data packet can be forwarded from the source interface to the destination interface.

[0051] Step S203: Based on the first target mask value and the second target mask value, determine whether communication is allowed between the first source interface and the first destination interface.

[0052] In this step, when a data packet is transmitted from the first source interface to the first destination interface, the router first obtains the mask values ​​corresponding to the two interfaces, namely the first target mask value (the MASK value of the source interface) and the second target mask value (the MASK value of the destination interface). Subsequently, the router can use these two mask values ​​to make a judgment to detect the connectivity between the first source interface and the first destination interface. For example, the first target mask value and the second target mask value are subjected to a logical AND operation. Based on the result of the logical AND operation, the router can determine whether the transmission of the data packet is allowed between the first source interface and the first destination interface. For example, in the preset isolation rule, if at least one bit in the operation result is 1, this indicates that there is an allowed communication path between the first source interface and the first destination interface, and the data packet can be forwarded. On the contrary, if the operation results are all 0, it means that the two interfaces should be blocked from communicating according to the preset isolation rule, and the data packet will not be forwarded to the destination interface, thereby achieving traffic isolation between subnetworks. For example, the first target mask value of the first source interface is 011, and the second target mask value of the first destination interface is 101. The logical AND result of the two is 001, so communication is allowed and data forwarding can be performed.

[0053] Step S204: forward the target data from the first source interface to the first destination interface.

[0054] In this step, once the router determines that communication between the first source interface and the first destination interface is allowed, meaning that the packet's forwarding path complies with the pre-set subnet isolation policy, it will forward the packet. This means that the packet will be transmitted from the first source interface (the data's origin) to the first destination interface (the data's destination), and this process is completed on the same bridge, without the need to create additional bridges or complex forwarding paths.

[0055] Through the above steps, the purpose of controlling data forwarding between different subnetworks under the same bridge is achieved, thereby achieving the technical effect of improving the flexibility and security of data forwarding and reducing network load and complexity. This further solves the technical problems of increased network complexity, increased resource consumption, and increased maintenance costs caused by the configuration of multiple bridges and DHCP servers in current data forwarding technology.

[0056] As an optional embodiment, determining the first source interface for forwarding target data in a target device includes: obtaining a virtual local area network VLAN identifier included in the target data, wherein the VLAN identifier is set based on a subnet of a source of the target data, and a device corresponding to the subnet of a source of the target data is a source device different from the target device; based on the VLAN identifier, determining the first source interface from multiple interfaces in the target device.

[0057] Optionally, VLAN (Virtual Local Area Network) identification is a technology used to segment network traffic and manage network resources. It allows a network to be divided into multiple virtual local area network segments, each of which can be independently managed and data isolated. In a mesh network environment, to identify and process target data from different subnets, each target data piece carries a specific VLAN identifier. This identifier is reflected in the target data's 802.1Q tag and is used to identify the subnet to which the target data belongs.

[0058] Figure 3 is a schematic diagram of a structure of an optional sub-network between two devices according to an embodiment of the present invention, such as Figure 3As shown in the figure, when an agent (slave device) sends target data to a controller (master device), the agent (slave device) acts as the source device and the controller (master device) acts as the destination device. Traffic from different subnets is tagged using 802.1Q VLANs. The controller (master device) identifies the subnet from which the target data originates by identifying its 802.1Q VLAN tag and then receives the data through a designated interface on the controller (master device), the first source interface. On the controller (master device), both the interface receiving the target data from the agent (slave device)'s subnet (the first source interface) and the data packet's final destination interface (the first destination interface) are marked with a forwarding control mask, enabling traffic isolation based on the forwarding control mask. Reverse communication from the controller (master device) to the agent (slave device) follows the same principle.

[0059] Figure 4 is a schematic diagram of an optional master device sending data to a slave device according to an embodiment of the present invention. Figure 5 This is a schematic diagram of an optional slave device sending data to a master device according to an embodiment of the present invention. As shown in the figure, the specific steps for implementing traffic isolation in a Mesh network can be as follows:

[0060] Step 1: Assign different 802.1Q VLAN IDs (e.g., VLAN 100, VLAN 200) to different subnetworks (e.g., main network, guest network).

[0061] Step 2: The agent (slave device) creates corresponding virtual VLAN interfaces for networking interfaces (including wired eth interfaces and wireless backhaul interfaces) under the same bridge (for example, the networking interfaces for wired networking are eth1.100 / eth1.200, and the networking interfaces for wireless networking are ath1.100 / ath1.200).

[0062] Step 3: When the agent (from the device) sends the target data through the networking interface, it adds the 802.1Q VLAN tag of the corresponding subnet to the target data;

[0063] Step 4: When the Controller (main device) receives the target data, it determines the subnet of its source by identifying the VLAN header, receives it using the corresponding first source interface, and then uses the forwarding control MASK to achieve isolation.

[0064] In addition to VLAN tags, methods for identifying data between subnets may include access control lists (ACLs) based on IP addresses or MAC addresses. VLAN tags are added at the data link layer (Layer 2), while ACLs are typically implemented at Layer 3 (Network Layer). VLAN tagging is generally faster because it involves fewer protocol processing layers. Configuring VLAN tags is often simpler than maintaining multiple ACL rules, especially in large-scale network environments. VLAN tags can simplify network management and reduce the risk of configuration errors.

[0065] As an optional embodiment, determine a second source interface for forwarding target data in a source device; determine an initial destination interface in the source device based on the MAC address of the target device; obtain a first interface identifier of the second source interface and a second interface identifier of the initial destination interface, wherein the first interface identifier is based on a subnet setting to which the second source interface belongs, and the second interface identifier is based on a subnet setting to which the initial destination interface belongs; determine a second destination interface for forwarding target data in the source device based on the first interface identifier and the second interface identifier, wherein the target data is transmitted from the second destination interface to the first source interface.

[0066] Optionally, Figure 6 FIG. 1 is a schematic diagram of an optional slave device providing multiple sub-networks using the same networking interface according to an embodiment of the present invention. Figure 6 As shown in the following example, in scenarios where an agent (slave device) uses the same backhaul interface to serve multiple subnets, traffic from the agent (slave device) to the controller (master device) may be unexpectedly intercepted or isolated. This is because when the controller (master device) simultaneously serves multiple subnets through a single backhaul interface on the agent (slave device), the MAC address of the controller (master device) may change in the agent (slave device)'s forwarding database (FDB). Therefore, interface identifiers are required to correct this issue.

[0067] In the source device, data is also forwarded between two interfaces, namely, from the second source interface to the second destination interface. The second source interface can be determined by the physical or logical interface where the data packet actually arrives. The second destination interface also needs to be determined, and can be determined by the initial destination interface and the interface identifier. The initial destination interface can refer to the initial destination interface located in the source device, which is initially obtained by querying the FDB table when the source device sends a data packet to the destination device. It is used to clearly indicate the source subnet of the second source interface. Correspondingly, the identifier of the subnet set to which the initial destination interface belongs is also used to determine the subnet to which the initial destination interface belongs. In the topology of a mesh network, due to possible FDB jumps, the initial destination interface initially queried may not be correct. In this case, the first interface identifier and the second interface identifier can be compared to check whether they match (that is, whether they belong to the same subnet). If they do not match, it is necessary to re-search for a destination interface that matches the first interface identifier to ensure that the target data is forwarded to the correct subnet. The interface identifier setting can automatically adapt to FDB changes without manual intervention. Traditional static configuration requires frequent adjustments when the topology changes, increasing the management burden.

[0068] As an optional embodiment, determining the second destination interface based on the first interface identifier and the second interface identifier includes: when the first interface identifier and the second interface identifier match, determining the initial destination interface as the second destination interface; or, when the first interface identifier and the second interface identifier do not match, determining the second destination interface based on the first interface identifier.

[0069] Optionally, when the first interface identifier and the second interface identifier match, for example, the first interface identifier and the second interface identifier are both 100, it means that the initial destination interface initially obtained through the FDB table query and the second source interface belong to the same type of subnetwork, so the target data can be forwarded safely, that is, the initial destination interface can be used as the second destination interface without further isolation or query operations. When the first interface identifier and the second interface identifier do not match, for example, the first interface identifier is 100 and the second interface identifier is 200, it means that the initial destination interface initially obtained through the FDB table query and the second source interface do not belong to the same type of subnetwork. In order to avoid the problem of erroneous interception and isolation, it is necessary to determine the destination interface that matches the first interface identifier and obtain the correct second destination interface to ensure that the target data is ultimately forwarded to the correct interface that complies with the subnetwork isolation rules. The above method can respond to changes in network topology in real time without manual intervention to update the FDB table or ACL, thereby improving processing efficiency and response speed.

[0070] Figure 7FIG. 1 is a flow chart of an optional method for determining a destination interface by using an interface identifier according to an embodiment of the present invention. Figure 7 The specific steps are as follows:

[0071] Step 1: Based on the network the user accesses, mark the interface to which the user is connected with its network ID, i.e., interface ID (e.g., ID100, ID200);

[0072] Step 2: When the agent (slave device) queries the destination interface of the data packet, it first queries the destination interface through the FDB table;

[0073] Step 3: If the destination interface (eg, eth1.100) does not match the network ID of the source interface (eg, ID200), the corresponding interface (eg, eth1.200) is found based on the network ID of the source interface and updated as the new forwarding destination interface.

[0074] The network ID, or interface identifier, is generally set to match the VLAN ID of the corresponding interface. For example, if the guest network interface is eth1.200 or ath1.200, its network ID is generally 200. In addition, other non-VLAN interfaces may also belong to the guest network ID 200, such as the wireless interface ath3 corresponding to the open guest network SSID. Setting this to be consistent is for ease of understanding. The core of the network ID is that all interfaces within the same subnet must be consistent. All physical device interfaces and VLAN device interfaces within the subnet must have the same network ID. This grouping scope is broader than the VLAN ID.

[0075] As an optional embodiment, obtaining a first target mask value and a second target mask value includes: obtaining a first authority value of the subnet to which the first source interface belongs and a second authority value of the subnet to which the first destination interface belongs; determining a first initial mask value of the first source interface based on the first authority value; determining a second initial mask value of the first destination interface based on the second authority value; receiving a first authority request and a second authority request; adjusting the first initial mask value based on the first authority request to obtain a first target mask value; adjusting the second initial mask value based on the second authority request to obtain a second target mask value.

[0076] Optionally, each subnet can be assigned a permission value, representing its priority and permission level during data forwarding. Permission values ​​can be set differently to distinguish between different network hierarchies, such as primary networks and guest networks. The initial mask values ​​for the first source interface and the first destination interface are determined based on the permission values ​​of their respective subnets. The initial mask value can be a fixed value or calculated based on the permission value. When a network administrator or user needs to adjust the data forwarding permissions for a subnet, they can send a permission request, such as increasing or decreasing the subnet's permission value, to adapt to changing network requirements. Upon receiving the permission request, the initial mask value can be adjusted based on the new permission value. The adjusted mask value, called the target mask value, is applied to the corresponding interface to control the forwarding of the target data. The target mask value is directly related to the interface's permission value, ensuring that the transmission of the target data complies with network isolation permissions. Forwarding of target data packets can also be controlled using fixed or static mask values. For example, a fixed mask value can be set for each subnet, preventing dynamic adjustment. This approach works when permissions remain unchanged, but it is less flexible when network isolation policies need to be flexibly adjusted.

[0077] As an optional embodiment, based on the first target mask value and the second target mask value, determining whether communication is allowed between the first source interface and the first destination interface includes: performing a logical operation on the first target mask value and the second target mask value to obtain an operation result; based on the operation result and a preset threshold, determining whether communication is allowed between the first source interface and the first destination interface.

[0078] Optionally, a logical operation is performed on the obtained first target mask value and the second target mask value, typically a logical AND operation (AND). The purpose of this step is to determine whether the first source interface and the first destination interface comply with the data transmission rules. The preset threshold is used to determine whether the result of the logical operation allows the transmission of the data packet. For example, the two thresholds can be preset to 0 and 1 respectively. When the result of the logical operation is 1, it is determined that communication is allowed between the first source interface and the first destination interface, and the target data is allowed to be forwarded; conversely, when the result of the logical operation is 0, it is determined that the first source interface and the first destination interface are isolated and the target data is not allowed to be forwarded.

[0079] Figure 8 FIG. 1 is a flow chart of an optional method for implementing data isolation by forwarding control MASK according to an embodiment of the present invention. Figure 8 The specific steps are as follows:

[0080] Step 1: Configure the forwarding control mask for the interface so that the result of a logical AND operation with the mask value of the subnetwork interface to be isolated is zero. For the interface to maintain communication, the result of the logical AND operation is non-zero.

[0081] Step 2: When the router bridge forwards the target data, the forwarding module calculates the logical AND value of the forwarding control mask of the first source interface and the first destination interface. If the result is not zero, the data packet is allowed to be forwarded; otherwise, forwarding is prohibited.

[0082] For a single router, the configuration of 802.1Q VLAN and network ID in the above embodiment is not mandatory, only the forwarding control MASK is necessary. The forwarding control MASK supports various network interface types, including but not limited to physical interface / VLAN interface, wired interface / wireless interface, etc., which corresponds to supporting the main network wireless interface / guest network wireless interface / wired interface, etc. on the router. The implementation of data isolation is completely based on the forwarding control MASK of the source interface and the destination interface, and various types of network interfaces can support forwarding control MASK. Data isolation of different subnets can also be achieved using static access control lists (ACLs) or MAC address-based filtering rules. For example, a fixed ACL rule is set for each subnet to only allow communication between specific MAC addresses or IP addresses. However, setting the mask value and threshold is simpler than maintaining a huge ACL list or MAC address filtering rules, reducing the complexity of network configuration and the possibility of errors.

[0083] As an optional embodiment, a method for isolating traffic between different subnetworks (e.g., primary network, guest network) on a single router, as well as between subnetworks across multiple routers in a mesh network, is also proposed. This method utilizes three core configuration items: forwarding control mask, 802.1Q VLAN, and network ID, along with corresponding control isolation algorithms, to successfully isolate traffic between different subnetworks on the same bridge. The forwarding control mask addresses the technical issue of data isolation between different subnetwork interfaces on a single bridge; 802.1Q VLAN primarily enables cross-router subnetwork packet identification and grouping; and network ID, building on the former, groups all interfaces on multiple routers across the entire network topology by subnetwork. Combined with a corresponding algorithm, this method isolates traffic across subnetworks and ensures quality of service across the entire network topology. For example, network ID grouping addresses the issue of inadvertent traffic interception in mesh networks, where routers rely solely on the forwarding database (FDB) for forwarding, potentially due to FDB hopping on front-end devices.

[0084] According to an embodiment of the present invention, a data forwarding device is provided. Figure 9 is a structural block diagram of a data forwarding device according to an embodiment of the present invention. Figure 9As shown, the data forwarding device includes: a first determination module 91, an acquisition module 92, a second determination module 93 and a forwarding module 94. The data forwarding device is described below.

[0085] The first determining module 91 is configured to determine a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge.

[0086] The acquisition module 92 is connected to the determination module 91 and is used to obtain a first target mask value and a second target mask value, wherein the first target mask value is the target mask value corresponding to the first source interface and the second target mask value is the target mask value corresponding to the first destination interface.

[0087] The second determining module 93 is connected to the acquiring module 92 and is configured to determine whether communication is allowed between the first source interface and the first destination interface based on the first target mask value and the second target mask value.

[0088] The forwarding module 94 is connected to the second determining module 93 and is configured to forward the target data from the first source interface to the first destination interface.

[0089] It should be noted here that the above-mentioned first determination module 91, acquisition module 92, second determination module 93 and forwarding module 94 correspond to steps S201 to S204 in the embodiment, and the instances and application scenarios implemented by multiple modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments.

[0090] According to an embodiment of the present invention, a computer-readable storage medium is provided, which includes a stored executable program, wherein when the executable program runs, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned data forwarding methods.

[0091] Optionally, in this embodiment, a computer-readable storage medium is configured to store program code for performing the following steps: determining a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; obtaining a first target mask value and a second target mask value, wherein the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first destination interface; based on the first target mask value and the second target mask value, determining that communication is allowed between the first source interface and the first destination interface; and forwarding the target data from the first source interface to the first destination interface.

[0092] According to an embodiment of the present invention, an electronic device is provided, comprising: a memory storing an executable program; and a processor configured to run the program, wherein any one of the above-mentioned data forwarding methods is executed when the program is run.

[0093] Optionally, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: determine the first source interface and the first destination interface for forwarding the target data in the target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; obtain the first target mask value and the second target mask value, wherein the first target mask value is the target mask value corresponding to the first source interface, and the second target mask value is the target mask value corresponding to the first destination interface; based on the first target mask value and the second target mask value, determine that communication is allowed between the first source interface and the first destination interface; forward the target data from the first source interface to the first destination interface.

[0094] According to an embodiment of the present invention, a computer program product is provided, including a computer program, which implements the steps of any of the above-mentioned data forwarding methods when executed by a processor.

[0095] Optionally, in this embodiment, when the computer program is executed by the processor, it can determine the first source interface and the first destination interface for forwarding target data in the target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; obtain a first target mask value and a second target mask value, wherein the first target mask value is the target mask value corresponding to the first source interface, and the second target mask value is the target mask value corresponding to the first destination interface; based on the first target mask value and the second target mask value, determine that communication is allowed between the first source interface and the first destination interface; and forward the target data from the first source interface to the first destination interface.

[0096] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0097] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0099] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0100] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0101] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0102] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data forwarding method, characterized in that: include: Determining a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; Obtain a first target mask value and a second target mask value, wherein the first target mask value is the target mask value corresponding to the first source interface, and the second target mask value is the target mask value corresponding to the first destination interface; Determining, based on the first target mask value and the second target mask value, that communication is permitted between the first source interface and the first destination interface; The target data is forwarded from the first source interface to the first destination interface.

2. The method according to claim 1, characterized in that The determining of the first source interface for forwarding target data in the target device includes: Obtaining a virtual local area network (VLAN) identifier included in the target data, wherein the VLAN identifier is set based on a subnetwork from which the target data originates, and a device corresponding to the subnetwork from which the target data originates is a source device different from the target device; Based on the VLAN identifier, the first source interface is determined from a plurality of interfaces in the target device.

3. The method according to claim 2, characterized in that Also includes: Determining a second source interface for forwarding the target data in the source device; Determining an initial destination interface in the source device based on the MAC address of the target device; Obtain a first interface identifier of the second source interface and a second interface identifier of the initial destination interface, wherein the first interface identifier is set based on the subnet to which the second source interface belongs, and the second interface identifier is set based on the subnet to which the initial destination interface belongs; A second destination interface for forwarding the target data in the source device is determined based on the first interface identifier and the second interface identifier, wherein the target data is transmitted from the second destination interface to the first source interface.

4. The method according to claim 3, characterized in that The determining the destination interface based on the first interface identifier and the second interface identifier includes: In a case where the first interface identifier matches the second interface identifier, determining that the initial destination interface is the second destination interface; or, In a case where the first interface identifier does not match the second interface identifier, the second destination interface is determined based on the first interface identifier.

5. The method according to claim 1, wherein The obtaining of the first target mask value and the second target mask value includes: Obtaining a first authority value of the subnet to which the first source interface belongs and a second authority value of the subnet to which the first destination interface belongs; Determining a first initial mask value for the first source interface based on the first authority value; Determining a second initial mask value for the first destination interface based on the second authority value; receiving a first permission request and a second permission request; Adjusting the first initial mask value based on the first permission request to obtain the first target mask value; Based on the second permission request, the second initial mask value is adjusted to obtain the second target mask value.

6. The method according to any one of claims 1 to 5, characterized in that The determining, based on the first target mask value and the second target mask value, that communication is permitted between the first source interface and the first destination interface includes: Performing a logical operation on the first target mask value and the second target mask value to obtain an operation result; When the operation result is equal to a preset threshold, it is determined that communication between the first source interface and the first destination interface is allowed.

7. A data forwarding device, characterized in that: include: A first determining module is configured to determine a first source interface and a first destination interface for forwarding target data in a target device, wherein the first source interface and the first destination interface respectively belong to different subnetworks under the same bridge; an acquisition module, configured to acquire a first target mask value and a second target mask value, wherein the first target mask value is a target mask value corresponding to the first source interface, and the second target mask value is a target mask value corresponding to the first destination interface; a second determining module, configured to determine, based on the first target mask value and the second target mask value, whether communication is permitted between the first source interface and the first destination interface; A forwarding module is used to forward the target data from the first source interface to the first destination interface.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored executable program, wherein when the executable program is run, the device where the computer-readable storage medium is located is controlled to execute the data forwarding method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: include: a memory storing an executable program; A processor is used to run the program, wherein the program executes the data forwarding method according to any one of claims 1 to 6 when running.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data forwarding method according to any one of claims 1 to 6 are implemented.

Images