Network system and data packet transmission method

Abstract

The embodiment of the invention discloses a network architecture system and a data packet transmission method, and the system decouples a physical network and a logic network by setting the physical network and the logic network in different layers. Wherein the logic network layer utilizes a route target export value and a route target import value in a BGP (Border Gateway Protocol) route protocol, namely import and export values of Route-target attributes, to realize route receiving among different logic networks, and in this way, the different logic networks can share the same physical network. According to the mode, different logic networks are allowed to be dynamically adjusted and deployed under the condition that the physical network is not changed, a new logic network exists in the future, deployment can be completed on the original physical network only by simple configuration change, if a new data center exists, only one physical network needs to be deployed, independent establishment for each logic network is not needed, and the data center does not need to be changed. Therefore, the cost of physical equipment and the investment of network link resources are greatly reduced.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a network system and a data packet transmission method. Background Art

[0002] In the information technology infrastructure of modern enterprises, especially financial institutions like banks, network systems are used to support the interconnection and efficient transmission of various business systems, while ensuring high security and compliance. Currently, network systems generally adopt a single-layer network architecture, which closely integrates the physical and logical networks. The logical network is subdivided into multiple logical network partitions based on the nature of the business and the target of service. For example, within a bank data center, the logical network is subdivided into online banking, third-party, production system, and operations management zones, with each logical network partition having exclusive access to physical network resources. Access between different logical network partitions requires secure isolation through access control devices, thereby preventing unauthorized external or internal access to systems in different logical network partitions.

[0003] However, this single-layer network structure has poor scalability. When adding a new data center, all nodes in the newly added data center must establish a one-to-one physical network connection with all nodes in the existing data center. This fully connected model results in high equipment procurement and maintenance costs when there are a large number of data centers and nodes, and also creates huge network bandwidth requirements. Summary of the Invention

[0004] The embodiments of the present application provide a network system and a data packet transmission method for reducing equipment procurement and maintenance costs and reducing network bandwidth requirements when the number of data centers increases.

[0005] In a first aspect, an embodiment of the present application provides a network system, the system comprising: a physical network layer and a logical network layer; the physical network layer deploys a physical network, and the logical network layer deploys a logical network partition;

[0006] The physical network layer deploys n edge service nodes, and the physical network layer is used to connect the n edge service nodes, where n is an integer greater than or equal to 2;

[0007] The logical network layer deploys m service logical network partitions, where the service logical network partitions indicate logical network partitions deployed on the edge service nodes among the n edge service nodes; m is an integer greater than, equal to, or equal to n;

[0008] The logical network layer is used to enable the n edge service nodes to exchange routing information, and each of the m service logical network partitions receives routing information of the same logical network partition, wherein the routing information carries a routing target derived value;

[0009] Among them, if the first logical network partition and the second logical network partition are the same logical network partition, the routing target import value of the first logical network partition is configured to match the routing target export value of the second logical network partition, and the routing target export value of the first logical network partition is configured to match the routing target import value of the second logical network partition, and the first logical network partition and the second logical network partition are any two partitions of the m business logical network partitions.

[0010] Optionally, the physical network layer further includes:

[0011] A core switching node and a physical link, wherein the physical link indicates a physical link between the n boundary service nodes and the core interaction node.

[0012] Optionally, the logical network layer is further configured to:

[0013] Enabling each of the service logical network partitions to reject routing information of different logical network partitions;

[0014] If the first logical network partition and the second logical network partition are different logical network partitions, the routing target import value of the first logical network partition is configured to not match the routing target export value of the second logical network partition, and the routing target export value of the first logical network partition is configured to not match the routing target import value of the second logical network partition.

[0015] Optionally, the logical network layer further includes a core logical network partition, and the logical network layer is further configured to:

[0016] If the first logical network partition and the second logical network partition are different logical network partitions, the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, and the core logical network partition is configured to exchange routing information between the first logical network partition and the second logical network partition.

[0017] Optionally, an access control device is deployed in each of the m business logical network partitions, and the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, including:

[0018] The first logical network partition enters the core logical network partition through the access control device deployed in the first logical network partition, and the second logical network partition enters the core logical network partition through the deployed access control device to perform routing information interaction in the core logical network partition.

[0019] Optionally, the physical network layer further includes: a value-added service node, the value-added service node being interconnected with the core switching node;

[0020] The value-added service node includes at least two access control devices and a core logical network partition; the same logical network partition corresponds to one access control device; the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, including:

[0021] The first logical network partition enters the core logical network partition through the corresponding access control device deployed by the value-added service node; the second logical network partition enters the core logical network partition through the corresponding access control device deployed by the value-added service node to exchange routing information in the core logical network partition.

[0022] Optionally, the n edge service nodes are located in different data centers, and each data center is deployed with one core switching node, and the core switching nodes in different data centers are connected.

[0023] Optionally, the physical network layer is used for connectivity between the n border service nodes, including: the physical network layer is used for connectivity between the n border service nodes via a unicast IPV4 protocol family of a BGP routing protocol;

[0024] The logical network layer is used to enable the n border service nodes to exchange routing information, including: the service logical network partition deployed by the logical network layer is used to enable the n border service nodes to exchange routing information through the EVPN protocol family of the BGP routing protocol.

[0025] In a second aspect, an embodiment of the present application provides a data packet transmission method, which is applied to a network system, wherein the system includes: a physical network layer and a logical network layer; the physical network layer deploys a physical network, and the logical network layer deploys a logical network;

[0026] The physical network layer deploys n edge service nodes, and the physical network layer is used to connect the n edge service nodes, where n is an integer greater than or equal to 2;

[0027] The logical network layer deploys m service logic network partitions, where the service logic network partitions indicate service logic network partitions deployed on the edge service nodes among the n edge service nodes; m is an integer greater than, equal to, or equal to n;

[0028] The logical network layer is used to enable the n edge service nodes to exchange routing information, and each of the m service logical network partitions receives routing information of the same logical network partition, wherein the routing information carries a routing target derived value;

[0029] Wherein, if the first business logical network partition and the second business logical network partition are the same business logical network partition, the routing target import value of the first business logical network partition is configured to match the routing target export value of the second business logical network partition, and the routing target export value of the first business logical network partition is configured to match the routing target import value of the second business logical network partition, and the first business logical network partition and the second business logical network partition are any two partitions of the m business logical network partitions, the method includes:

[0030] The source service logical network partition in the source edge service node sends the data packet to the target edge service node corresponding to the tunnel destination IP address.

[0031] Optionally, if the data packet is a data packet encapsulated in two layers, the two layers of encapsulation include: an inner layer encapsulation that encapsulates the tunnel source IP address corresponding to the source edge service node and the source partition identifier corresponding to the source logical network partition, and an outer layer encapsulation that encapsulates the tunnel destination IP address, the method further includes:

[0032] After receiving the data packet, the target service node removes the outer encapsulation of the data packet, obtains a source partition identifier corresponding to the source service logical network partition, and matches the target service logical network partition that belongs to the same service logical network partition as the source service logical network partition based on the source partition identifier.

[0033] In a third aspect, an embodiment of the present application provides a computer program product, which includes: a computer program (also referred to as code, or instructions), which, when executed, enables a computer to execute a method in any possible implementation of any of the above aspects.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program (also referred to as code, or instructions) that, when run on a computer, enables the computer to execute the method in any possible implementation of the second aspect above.

[0035] In a fifth aspect, embodiments of the present application provide a chip system comprising one or more processors configured to retrieve and execute instructions stored in a memory, thereby executing the method of any of the above aspects or any possible implementations of each aspect. The chip system may be composed of a chip or may include a chip and other discrete devices.

[0036] An embodiment of the present application provides a network architecture system and a data packet transmission method, the system comprising: a physical network layer and a logical network layer, wherein the physical network layer deploys a physical network, and the logical network layer deploys a logical network; the physical network layer deploys n border service nodes, and the physical network layer is configured to enable connectivity between the n border service nodes, where n is an integer greater than or equal to 2; the logical network layer deploys m service logical network partitions, wherein the m service logical network partitions include a service logical network partition for each of the n border service nodes; m is an integer greater than or equal to n; the logical network layer is configured to enable the n border service nodes to exchange routing information, and each of the m service logical network partitions receives routing information of the same service logical network partition, the routing information carrying a route target derived value; if a first logical network partition and a second logical network partition are the same logical network partition, the route target imported value of the first logical network partition matches the route target derived value of the second logical network partition, and the route target derived value of the first logical network partition matches the route target imported value of the second logical network partition, and the first logical network partition and the second logical network partition are any two of the m service logical network partitions.

[0037] That is, the embodiment of the present application decouples the physical network and the logical network by setting them at different layers respectively. Among them, the logical network layer uses the route target export value and route target import value in the BGP routing protocol, that is, the import and export values ​​of the Route-target attribute to realize the route reception between the business logic network partitions. In this way, different business logic networks can share the same physical network. This method allows dynamic adjustment and deployment of different logical networks without changing the physical network. In the future, if there are new logical networks, only simple configuration changes are needed to complete the deployment on the original physical network. If a new data center is built, only one physical network needs to be deployed without having to build it independently for each logical network. Therefore, the cost of physical equipment and the investment in network link resources are greatly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 An architectural block diagram of a network system provided in an embodiment of the present application;

[0040] Figure 2A A schematic diagram of the structure of a physical network layer provided in an embodiment of the present application;

[0041] Figure 2B A schematic diagram of the structure of another physical network layer provided in an embodiment of the present application;

[0042] Figure 3A A schematic diagram of the structure of a logical network layer provided in an embodiment of the present application;

[0043] Figure 3B A schematic diagram of another logical network structure layer provided in an embodiment of the present application;

[0044] Figure 4A A schematic diagram of the structure of a network system provided in an embodiment of the present application;

[0045] Figure 4B A schematic diagram of the structure of a network system provided in an embodiment of the present application;

[0046] Figure 4C A schematic diagram of the structure of another network system provided in an embodiment of the present application;

[0047] Figure 5 A schematic diagram of a logical network topology provided in an embodiment of the present application;

[0048] Figure 6 An interactive diagram of a data packet transmission method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in this embodiment with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0050] First, the technical terms involved in the embodiments of the present application are introduced.

[0051] Data forwarding plane: rules used to guide the actual forwarding of data packets.

[0052] Routing control plane: used to control routing distribution and form rules for physical and logical networks.

[0053] Routing protocol: implements routing distribution between network devices.

[0054] Border Gateway Protocol (BGP): A routing protocol widely used in various large-scale network architectures due to its powerful routing properties and field expansion capabilities.

[0055] The route target import value / export value, also known as the route-target attribute, is one of the routing extension attributes of the routing protocol. It is used to identify routes in different logical network partitions so that routes in the same logical network partition can be accepted or rejected.

[0056] Physical network: A network consisting of physical network devices and physical network links that maintains the data forwarding plane and the underlying network routing control plane.

[0057] Logical network: A network created by routing protocols that maintains the top-level network routing control plane.

[0058] Core switching node: A node that only runs routing protocols at the physical network layer and is responsible for connecting to edge service nodes.

[0059] Boundary service node: runs both the physical network layer routing protocol and the logical network layer routing protocol, and is responsible for controlling the routing and reception of the logical network to achieve logical isolation.

[0060] The following describes the network system provided by the embodiment of the present application with reference to the accompanying drawings.

[0061] Attachment Figure 1 This is an architectural block diagram of a network system provided in an embodiment of the present application. The network system 10 includes two layers, namely a physical network layer A and a logical network layer B.

[0062] Physical network layer A deploys the physical network. In this embodiment of the present application, physical network layer A deploys n border service nodes (respectively, border service nodes 1 to n), where n is an integer greater than or equal to 2, for example, n = 3. Physical network layer A is used to connect the n border service nodes. Logical network layer B deploys m service logical network partitions (respectively, logical network partitions 1 to m), where m is an integer greater than or equal to n.

[0063] The n border service nodes may be connected directly or through other switching nodes.

[0064] For example, Figure 2A This is a schematic diagram of the physical network layer structure provided in an embodiment of the present application. Physical network layer A includes three edge service nodes (service node 1, service node 2, and service node 3), a core switching node, and physical links between the edge service nodes and the core switching node. In this embodiment of the present application, the three edge service nodes are connected through the core switching node.

[0065] It should be noted that in the embodiment of the present application, the border service node and the core switching node are connected via the first protocol family of the routing protocol, wherein the first protocol family of the routing protocol is specifically the unicast IPV4 protocol family of the BGP routing protocol.

[0066] In the embodiment of the present application, n edge service nodes may be located in the same data center. Among them, the edge service nodes of the same data center can be connected through the same core switching node. Figure 2A As shown, n edge service nodes are located in the same data center.

[0067] In addition, the n edge service nodes can also be located in different data centers. For ease of explanation, the following example assumes that the number of n edge service nodes is 9 and that there are three data centers, specifically data center X, data center Y, and data center Z.

[0068] For example, Figure 2B A schematic diagram of another physical network layer structure provided in an embodiment of the present application. Physical network layer A includes data center X, data center Y, and data center Z. Data center X includes n1 edge service nodes, data center Y includes n2 edge service nodes, and data center Z includes n3 edge service nodes. n1, n2, and n3 are all positive integers and may be equal or different, and the sum of n1+n2+n3 is less than n.

[0069] like Figure 2B As shown, n1 is 3, n2 is 3, and n3 is also 3. For ease of distinction, the three edge service nodes of data center X are referred to as service node 11, service node 12, and service node 13; the three edge service nodes of data center Y are referred to as service node 21, service node 22, and service node 23; and the three edge service nodes of data center Z are referred to as service node 31, service node 32, and service node 33.

[0070] Furthermore, each data center can deploy p (p is an integer greater than 1) core switching nodes, and the core switching nodes of different data centers are connected. Figure 2B As shown, data center X further includes core switching node X, data center Y further includes core switching node Y, and data center Z further includes core switching node Z. Core switching node X, core switching node Y, and core switching node Z are interconnected.

[0071] It can be understood that if a new data center is added, it is only necessary to establish a connection between the core switching node of the new data center and the core switching node of the existing data center at the physical network layer to achieve interoperability between border business nodes. Therefore, this method can greatly reduce the deployment and maintenance costs of physical equipment compared to a single-layer network structure.

[0072] In the embodiment of the present application, the logical network layer B deploys a logical network. Specifically, the logical network layer deploys m service logical network partitions, where the service logical network partition indicates a logical network partition deployed on a border service node among n border service nodes; where m is an integer greater than, equal to, or equal to n.

[0073] The logical network layer enables n border service nodes to exchange routing information. In one specific implementation, at the logical network layer, the n border service nodes exchange routing information using the second protocol family of the BGP routing protocol. The second protocol family of the routing protocol can be the EVPN protocol family of the BGP routing protocol.

[0074] For example, Figure 3A This is a schematic diagram of the structure of a logical network layer provided in an embodiment of the present application. The logical network layer includes three edge service nodes, specifically the logical network partitions of service node 1, service node 2, and service node 3. The logical network partition of service node 1 includes logical network partition A and logical network partition B, the logical network partition of service node 2 includes logical network partition A and logical network partition C, and the logical network partition of service node 3 includes logical network partition B and logical network partition C.

[0075] It can be understood that the logical network partition A of business node 1 and the logical network partition A of business node 2 are the same logical network partition, the logical network partition B of business node 1 and the logical network partition B of business node 3 are the same logical network partition, and the logical network partition C of business node 2 and the logical network partition C of business node 3 are the same logical network partition.

[0076] In the embodiment of the present application, the routing information between the same logical network partitions is shared. Specifically, each of the m business logical network partitions receives the routing information of the same logical network partition. Figure 3AAs shown, the logical network partition A of service node 1 and the logical network partition A of service node 2 share routing information to form logical network A, the logical network partition B of service node 1 and the logical network partition B of service node 3 share routing information to form logical network B, and the logical network partition C of service node 2 and the logical network partition C of service node 3 share routing information to form logical network C.

[0077] In an embodiment of the present application, for any two of the m business logical network partitions, they are the first logical network partition and the second logical network partition, respectively. If the first logical network partition and the second logical network partition are the same logical network partition, the route target import value of the first logical network partition is configured to match the route target export value of the second logical network partition, and the route target export value of the first logical network partition is configured to match the route target import value of the second logical network partition. For example, the export value of the Route-target attribute of the first logical network partition is configured to be the same as the export value of the second logical network partition, and the import value of the Route-target attribute of the first logical network partition is configured to be the same as the import value of the second logical network partition.

[0078] For example, for Figure 3A As shown in the figure, the export value of logical network partition A of service node 1 and the import value of logical network partition A of service node 2 can be set to f1:m1, and the import value can be f2:m2. Among them, f1, m1, f2 and m2 are positive integers and can be the same or different. For example, if they are all 1, the export value of logical network partition A is 1:1 and the import value is 1:1.

[0079] Therefore, when the logical network partition A of business node 1 sends routing information, the routing information carries the export value. The logical network partition A of business node 2 checks the routing information and the export value. If the export value matches the import value set by itself, it can receive the routing information. Thus, the logical network partition A of business node 1 and the logical network partition A of business node 2 are connected.

[0080] It should be noted that the logical network partition C of business node 2 and the logical network partition C of business node 3, as well as the logical network partition B of business node 1 and the logical network partition B of business node 3, all use the same principle to set export values ​​and import values, which will not be repeated in the embodiments of this application.

[0081] In another specific implementation, if the first logical network partition and the second logical network partition belong to different logical network partitions, the route target import value of the first service logical network partition does not match the route target export value of the second service logical network partition, and the route target export value of the first service logical network partition does not match the route target import value of the second service logical network partition. As a result, the first logical network partition rejects routing information from different logical network partitions.

[0082] For example, see Figure 3A As shown, the first logical network partition is logical network partition C of service node 2, and the second logical network partition is logical network partition A of service node 1. Since these are different logical network partitions, the export value of logical network partition C of service node 2 can be set to n3:m3, and the import value can be set to n4:m4. Among the four data sets (n3 and f1, m3 and m1, n4 and f2, and m4 and m2), at least one of the arrays must be different. For example, n3, m3, n4, and m4 can all be set to 2, meaning that the export value of logical network partition C can be set to 2:2, and the import value can be set to 2:2.

[0083] Therefore, logical network partition A of service node 1 sends routing information, which carries the export value. Logical network partition C of service node 2 checks the routing information and finds that the export value does not match the import value set by itself, so it rejects the routing information.

[0084] In summary, the embodiments of the present application can set the same routing target attributes between the same logical network partitions and set different routing target attributes between different logical network partitions, which can ensure the security isolation between different logical network partitions and information sharing between the same logical network partitions, thereby enhancing network security and flexibility.

[0085] In another specific implementation, the network system includes multiple data centers. Figure 2B Taking the aforementioned data center X, data center Y, and data center Z as an example, the embodiment of the present application provides another corresponding logical network layer.

[0086] Attachment Figure 3BA schematic diagram of another logical network structure layer provided in an embodiment of the present application. In particular, service node 11 includes service logic network partition A and service logic network partition B, service node 12 includes service logic network partition A and service logic network partition C, service node 13 includes service logic network partition B and service logic network partition C, service node 21 includes service logic network partition A and service logic network partition B, service node 22 includes service logic network partition A and service logic network partition C, service node 23 includes service logic network partition B and service logic network partition C, service node 31 includes service logic network partition A and service logic network partition B, service node 32 includes service logic network partition A and service logic network partition C, and service node 33 includes service logic network partition B and service logic network partition C.

[0087] Same as attached Figure 3B The same logical network partition is configured with the same export and import values. Different logical network partitions have different export or import values. For example, business logical network partition A of all nodes has an export value of 1:1 and an import value of 1:1. Business logical network partition B of all nodes has an export value of 2:2 and an import value of 2:2. Business logical network partition C of all nodes has an export value of 3:3 and an import value of 3:3. Then, all business nodes in logical network partition A can connect via logical network A, all business nodes in logical network partition B can connect via logical network B, and all business nodes in logical network partition C can connect via logical network C.

[0088] Therefore, the same logical network partitions in different data centers can also exchange routing information, and different logical network partitions in different data centers can also be securely isolated.

[0089] Furthermore, if different logical network partitions want to exchange routing information, they can do so by accessing the core logical network partition through an access control device. In an embodiment of the present application, the core logical network partition is configured to exchange routing information between the first logical network partition and the second logical network partition. In an embodiment of the present application, the access control device corresponding to the first logical network partition allows legitimate data communication requests between the first logical network partition and the second logical network partition, and rejects illegitimate data communication requests. For example, the access control device is a firewall. For ease of explanation, the following description uses the firewall as an example.

[0090] It should be noted that when a destination terminal in the first logical network partition does not need to communicate data with a source terminal in the second logical network partition, the firewall corresponding to the first logical network partition is configured to deny the source terminal in the second logical network partition access to the destination terminal in the first logical network partition through the device.

[0091] The embodiments of the present application provide multiple implementations of a first logical network partition entering a core logical network partition through an access controller to perform routing information interaction with a second logical network partition.

[0092] Example 1, attached Figure 4A , is a structural diagram of a network system provided in an embodiment of the present application, in which a firewall is deployed in each logical network partition. Figure 4A This example demonstrates deploying firewall A in logical network partition A, firewall B in logical network partition B, and firewall C in logical network partition C. Logical network partitions A, B, and C belong to different logical network partitions. Logical network partitions A and B interact through routing via the core logical network partition. Specifically, the source device in logical network partition A can use firewall A to allow legitimate data communication requests between the destination devices in logical network partition A and logical network partition B, deny illegitimate data communication requests, and send legitimate data to the core logical network partition. Logical network partition B can obtain legitimate data from the core logical network partition through firewall B, thereby interacting with data within the core logical network partition.

[0093] Similarly, logical network partitions B and C communicate through routing via the core logical network partition. Source devices in logical network partition B can exchange data with destination devices in logical network partition C through firewalls B and C. Logical network partitions A and C communicate through routing via the core logical network partition. Source devices in logical network partition A can exchange data with destination devices in logical network partition C through firewalls A and C.

[0094] Example 2, attached Figure 4B This is a schematic diagram of the structure of a network system provided by an embodiment of the present application. The network system includes core switching nodes, edge service nodes, and value-added service nodes.

[0095] In an embodiment of the present application, a value-added service node includes at least two access control devices and a core logical network partition; each logical network partition corresponds to one access control device; a first logical network partition and a second logical network partition exchange data within the core logical network partition via their respective access control devices. The first logical network partition exchanges data with the second logical network partition via the first access control device, the core logical network partition, and a second access controller. The first access control device is the access control device corresponding to the first logical network partition among the at least two access control devices, and the second access control device is the access control device corresponding to the second logical network partition among the at least two access control devices. The core logical network partition includes access identifiers for the at least two access control devices, which are used to uniquely identify the corresponding access control devices.

[0096] For ease of explanation, Figure 4B As shown, the edge service nodes specifically include service node 1, service node 2, and service node 3. Service node 1 deploys logical network partition A and logical network partition B, service node 2 deploys logical network partition A and logical network partition C, and service node 3 deploys logical network partition B and logical network partition C. Value-added service nodes include the firewall corresponding to logical network partition A, the firewall corresponding to logical network partition B, and the core logical network partition. The core logical network partition includes access identifiers for all firewalls. The access identifier is used to uniquely identify the firewall.

[0097] In this embodiment of the present application, routing information exchange between different logical network partitions is achieved through the firewall of the value-added service node in the core logical network partition. The core logical network partition contains all routing information for all logical network partitions. Furthermore, a source device in logical network partition A of service node 1 can exchange data with a destination device in logical network partition B of service node 3 through the firewall of logical network partition A in the value-added service node, the core logical network partition, and the firewall of logical network partition B.

[0098] Specifically, the core logical network partition will send routing information to the firewalls of all logical network partitions. Among them, firewall B is configured to allow data packets sent by a source device in the logical network partition A of business node 1 to pass. Firewall B will send the received data packets to the logical network partition B of business node 3, and then send them to the destination device.

[0099] This approach only requires deploying one firewall for the same logical network partition at the value-added service node, thus reducing the cost of deploying the firewall.

[0100] Furthermore, for different logical network partitions in different data centers, routing information interaction can be achieved in the following ways.

[0101] For example, Figure 4C This is a schematic diagram of the structure of another network system provided in an embodiment of the present application. The network system includes data center X and data center Y.

[0102] Data center X includes one value-added service node, and data center Y includes one value-added service node. Logical network partition A of service node 11 in data center X and logical network partition B of service node 11 in data center Y perform routing interaction through core logical network partition X.

[0103] Specifically, in one implementation, logical network partition A of data center X publishes routing information through the core logical network partition of data center X, and logical network partition B of data center Y publishes routing information through the core logical network partition of data center Y. The core logical network partitions of data centers X and Y belong to the same logical network partition and exchange routing information. Furthermore, the source device in logical network partition A of data center X first sends the information to the firewall corresponding to logical network partition A of the value-added service node of data center X. The information then reaches the core logical network partition of data center X, and is then sent through the core logical network partition of data center Y to the firewall corresponding to logical network partition B, thereby exchanging data with the destination device in logical network partition B of the service node 11 of data center Y.

[0104] It should be noted that the embodiments of the present application can also be implemented in other ways, and the embodiments of the present application are not specifically limited.

[0105] In a specific use, for example, Figure 5 This is a schematic diagram of a logical network topology provided in an embodiment of the present application. In this structure, the boundary service nodes of data center X are the Internet and the backbone network, and the boundary service nodes of data center Y are the Internet and the firewall.

[0106] The Internet and logical network partition A belong to the same logical network, the backbone network and logical network partition B belong to the same logical network, and the firewall and logical network partition C belong to the same logical network. In this case, data center Z can implement logical network partition A and share the Internet egress of data center X and data center Y.

[0107] Similarly, data center Z can implement logical network partition B, share the backbone network egress of data center X, and implement logical network partition C to share the firewall of data center Y, thus achieving firewall resource sharing.

[0108] The embodiment of the present application decouples the physical network and the logical network by setting them at different layers respectively. Among them, the physical network layer uses the first protocol family of the routing protocol to connect each boundary service node to ensure the forwarding of data packets, while the logical network layer uses the second protocol stack of the routing protocol to control the routing of the logical network, and realizes the routing reception between logical network partitions through the route target export value and the route target import value, that is, the import and export values ​​of the Route-target attribute. In this way, different logical network partitions are shared on the physical network. This method allows dynamic adjustment and deployment of different logical networks without changing the physical network. In the future, if there is a new logical network, it only needs a simple configuration change to complete the deployment on the original physical network. If a new data center is built, only one physical network needs to be deployed without having to build it independently for each logical network, thereby greatly reducing the cost of physical equipment and the investment in network link resources.

[0109] In addition, in the embodiment of the present application, various types of internal and external channels and firewall resources can be shared across data centers, and there is no need to deploy a full set of functions in each data center. And in the network system provided in the embodiment of the present application, various types of software, hardware, traditional networks, heterogeneous manufacturers' products and other future technology stacks can be connected to the network core through a unified border service node, providing compatibility that will continue to the past and the future. Furthermore, the physical network is transparent to the logical network because the logical network only focuses on the tunnel connectivity between border service nodes and does not care about the underlying path through which the tunnel is connected. Therefore, in the scenario where a device or link failure or other topology changes occur in the underlying physical network, and when the underlying physical network undergoes planned maintenance of devices or links, the failed device or the device to be maintained can be smoothly phased out, and the business is basically unaffected.

[0110] Furthermore, in the data forwarding plane, data packets can be transmitted through the network system of the above-mentioned double-layer network structure. Figure 6 Provide a detailed and complete description.

[0111] Attachment Figure 6 An interactive diagram of a data packet transmission method provided in an embodiment of the present application, the method includes the following contents:

[0112] S610: The source edge service node encapsulates the target data packet to be sent.

[0113] The target data packet refers to the data packet that needs to be sent to the target service node.

[0114] In the embodiment of the present application, the source service logic node in the source boundary service node encapsulates the target data packet to obtain an encapsulated data packet.

[0115] Furthermore, the source service logical network partition can encapsulate the target data packet into two layers, specifically including an inner layer encapsulation that encapsulates the tunnel source IP address corresponding to the source boundary service node and the source partition identifier corresponding to the source logical network partition, and an outer layer encapsulation that encapsulates the tunnel destination IP address.

[0116] S620: The source edge service node sends the encapsulated target data packet to the target service node.

[0117] In a specific implementation, the source service logic network partition may send the encapsulated data packet to the target service node through the tunnel destination IP address.

[0118] Correspondingly, the target service node receives the encapsulated data packet.

[0119] S630: The target edge service node parses the encapsulated data packet to obtain a target data packet.

[0120] In a specific implementation, after receiving the data packet, the target service node removes the outer encapsulation of the data packet, obtains a source partition identifier corresponding to the source logical network partition, and matches the target logical network partition that belongs to the same logical network partition as the source logical network partition based on the source partition identifier.

[0121] For example, in one specific implementation, tunneling technology can be used to implement packet forwarding. Tunneling technology includes an outer tunnel layer and an inner tunnel layer. The outer tunnel layer is responsible for forwarding data between edge service nodes, directing forwarding based on the routing of the underlying physical network. The inner tunnel layer uses a partition identifier (e.g., a VNI) to distinguish different logical network partitions. A VNI is a positive integer, e.g., VNI = 100.

[0122] When the data packet reaches the peer edge service node, the outer encapsulation is removed to reveal the inner encapsulation. The peer edge service node matches the VNI value and forwards the data packet to the corresponding logical network partition.

[0123] For example, when a data packet is forwarded from logical network partition A, the packet's source and destination IP addresses, as well as the VNI value corresponding to the logical network partition (such as 100), are encapsulated in the packet to complete the inner encapsulation. The tunnel source and destination IP addresses between the border service nodes are then encapsulated to complete the outer encapsulation. When the data packet is forwarded to the opposite border service node based on the tunnel destination IP in the outer encapsulation, the outer encapsulation is removed, and the VNI value in the inner encapsulation (which is 100) is checked. It is matched to logical network partition A and sent to the logical network partition A of the border service node. The packet is then forwarded based on the actual destination IP address of the service. Because the VNI value of logical network partition B (such as 200) is used, the data packet is not forwarded to the logical network partition B of the border service node.

[0124] It should be noted that in other embodiments, other encapsulation and routing control technologies can also be used to achieve data packet transmission and logical network construction, which is not specifically limited in the embodiments of this application.

[0125] The embodiment of the present application realizes efficient transmission of data packets between different logical network partitions through a two-layer network architecture. Furthermore, when a data packet is sent from a source logical network partition, it will be encapsulated twice: one is an inner encapsulation based on the tunnel source IP address and source partition identifier of the source boundary service node, and the other is an outer encapsulation based on the tunnel destination IP address of the target boundary service node. Through the two-layer encapsulation, the accurate transmission of data packets between the physical network and the logical network is ensured, and the reliability and security of the network are improved. At the same time, through the routing control of the logical network layer, isolation and on-demand intercommunication between different logical network partitions are realized.

[0126] Based on the methods provided in the embodiments of the present application, the present application also provides a chip system, which includes one or more processors configured to retrieve and execute instructions stored in a memory, thereby executing the methods of the embodiments of the present application. The chip system can be composed of a chip or can include a chip and other discrete devices.

[0127] Among them, the chip system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0128] According to the method provided in the embodiments of the present application, the present application also provides a computer program product, which includes: computer program code, which, when running on a computer, enables the computer to execute the various steps or processes executed by the network device and terminal device in any of the aforementioned method embodiments.

[0129] According to the method provided in the embodiments of the present application, the present application also provides a computer-readable storage medium, which stores program code. When the program code runs on a computer, the computer executes the various steps or processes performed by the network device and terminal device in any of the aforementioned method embodiments.

[0130] The computer-readable storage medium may be the aforementioned volatile memory or non-volatile memory, or may include both volatile memory and non-volatile memory.

[0131] In the embodiments of this application, each term and English abbreviation is provided for convenience of description and shall not constitute any limitation to this application. This application does not exclude the possibility of defining other terms that can achieve the same or similar functions in existing or future agreements.

[0132] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

Claims

1. A network system, characterized in that: The system includes: a physical network layer and a logical network layer; the physical network layer deploys a physical network, and the logical network layer deploys logical network partitions; The physical network layer deploys n edge service nodes, and the physical network layer is used to connect the n edge service nodes, where n is an integer greater than or equal to 2; The logical network layer deploys m service logical network partitions, where the service logical network partitions indicate logical network partitions deployed on the edge service nodes among the n edge service nodes; m is an integer greater than, equal to, or equal to n; The logical network layer is used to enable the n edge service nodes to exchange routing information, and each of the m service logical network partitions receives routing information of the same logical network partition, wherein the routing information carries a routing target derived value; Among them, if the first logical network partition and the second logical network partition are the same logical network partition, the routing target import value of the first logical network partition is configured to match the routing target export value of the second logical network partition, and the routing target export value of the first logical network partition is configured to match the routing target import value of the second logical network partition, and the first logical network partition and the second logical network partition are any two partitions of the m business logical network partitions.

2. The system according to claim 1, wherein: The physical network layer also includes: A core switching node and a physical link, wherein the physical link indicates a physical link between the n boundary service nodes and the core interaction node.

3. The system according to claim 2, characterized in that The logical network layer is also used to: Enabling each of the service logical network partitions to reject routing information of different logical network partitions; If the first logical network partition and the second logical network partition are different logical network partitions, the routing target import value of the first logical network partition is configured to not match the routing target export value of the second logical network partition, and the routing target export value of the first logical network partition is configured to not match the routing target import value of the second logical network partition.

4. The system according to claim 3, characterized in that The logical network layer also includes a core logical network partition, and the logical network layer is further used to: If the first logical network partition and the second logical network partition are different logical network partitions, the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, and the core logical network partition is configured to exchange routing information between the first logical network partition and the second logical network partition.

5. The system according to claim 4, characterized in that An access control device is deployed in each of the m business logical network partitions, and the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, including: The first logical network partition enters the core logical network partition through the access control device deployed in the first logical network partition, and the second logical network partition enters the core logical network partition through the deployed access control device to perform routing information interaction in the core logical network partition.

6. The system according to claim 4, characterized in that The physical network layer further includes: a value-added service node, the value-added service node being interconnected with the core switching node; The value-added service node includes at least two access control devices and a core logical network partition; the same logical network partition corresponds to one access control device; the first logical network partition and the second logical network partition exchange routing information through the core logical network partition, including The first logical network partition enters the core logical network partition through the corresponding access control device deployed by the value-added service node; the second logical network partition enters the core logical network partition through the corresponding access control device deployed by the value-added service node to exchange routing information in the core logical network partition.

7. The system according to claim 2, wherein: The n edge service nodes are located in different data centers, and each data center is deployed with one core switching node, and the core switching nodes of different data centers are connected.

8. The system according to claim 1, wherein: The physical network layer is used for connecting the n border service nodes, including: the physical network layer is used to connect the n border service nodes through the unicast IPV4 protocol family of the BGP routing protocol; The logical network layer is used to enable the n border service nodes to exchange routing information, including: the service logical network partition deployed by the logical network layer is used to enable the n border service nodes to exchange routing information through the EVPN protocol family of the BGP routing protocol.

9. A data packet transmission method, characterized in that: Applied to a network system, the system includes: a physical network layer and a logical network layer; the physical network layer deploys a physical network, and the logical network layer deploys logical network partitions; The physical network layer deploys n edge service nodes, and the physical network layer is used to connect the n edge service nodes, where n is an integer greater than or equal to 2; The logical network layer deploys m service logic network partitions, where the service logic network partitions indicate service logic network partitions deployed on the edge service nodes among the n edge service nodes; m is an integer greater than, equal to, or equal to n; The logical network layer is used to enable the n edge service nodes to exchange routing information, and each of the m service logical network partitions receives routing information of the same logical network partition, wherein the routing information carries a routing target derived value; Wherein, if the first business logical network partition and the second business logical network partition are the same business logical network partition, the routing target import value of the first business logical network partition is configured to match the routing target export value of the second business logical network partition, and the routing target export value of the first business logical network partition is configured to match the routing target import value of the second business logical network partition, and the first business logical network partition and the second business logical network partition are any two partitions of the m business logical network partitions, the method includes: The source service logical network partition in the source edge service node sends the data packet to the target edge service node corresponding to the tunnel destination IP address.

10. The method according to claim 9, characterized in that If the data packet is a data packet that passes through two layers of encapsulation, the two layers of encapsulation include: an inner layer of encapsulation that encapsulates the tunnel source IP address corresponding to the source edge service node and the source partition identifier corresponding to the source logical network partition, and an outer layer of encapsulation that encapsulates the tunnel destination IP address, the method further includes: After receiving the data packet, the target service node removes the outer encapsulation of the data packet, obtains a source partition identifier corresponding to the source service logical network partition, and matches the target service logical network partition that belongs to the same service logical network partition as the source service logical network partition based on the source partition identifier.

Images