An access request processing method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a kind of access request processing method, device, electronic equipment and storage medium, related to network communication technical field, applied to network equipment, network equipment is configured with the ACL rule of the ID of the micro segment of domain name belonging to the access authority defined, and the binding relationship between the IP address of domain name of access authority defined and the ID of micro segment is recorded for the ACL rule configured, method includes: receiving the access request of terminal for the first IP address for accessing network equipment;In response to the message forwarding unit in network equipment determines that the ID of the first micro segment bound to the first IP address belongs to the ID of the micro segment of domain name belonging to the access allowed recorded in the first ACL rule, forwarding the access request of terminal, wherein, the first ACL rule is: the ACL rule of the ACL rule configured in the terminal accessed port is applied to. The scheme provided by the embodiments of the present application can reduce the delay of terminal network access.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to an access request processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] Access Control Lists (ACLs) are a commonly used network security technology. This technology allows you to define a series of packet filtering rules on network devices such as routers and switches, thereby configuring the access permissions of connected terminals for network resources.

[0003] In some scenarios, the ACL rules configured on network devices include access rules for domain names. In this case, the network device's processor needs to send the access rules for each IP address corresponding to the aforementioned domain name to the packet forwarding unit. Thus, when a terminal accessing the network device requests access to a certain IP address, the packet forwarding unit determines, based on the received access rules, whether the terminal has the necessary permissions for that IP address. If so, the terminal's access request is forwarded; otherwise, forwarding is rejected.

[0004] When the IP addresses corresponding to the aforementioned domain names change, the processor needs to send updated access rules to the packet forwarding unit. If the number of domain names with changing IP addresses is large, or if the number of changing IP addresses is also large, the amount of ACL rule data the processor needs to send is significant, potentially leading to message backlog and prolonged processing time. If the aforementioned access rules have not yet been sent when a terminal requests access to a specific IP address, the packet forwarding unit cannot process the access request immediately but must wait for the rules to be sent, resulting in higher latency for the terminal's network access. Summary of the Invention

[0005] The purpose of this invention is to provide an access request processing method, apparatus, electronic device, and storage medium to reduce the latency of terminal network access. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of the present invention provide an access request processing method applied to a network device. The network device is configured with ACL rules specifying the ID of a micro-segment to which a domain name with specified access permissions belongs, and the configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. The method includes:

[0007] Receive an access request from a terminal accessing the network device for a first IP address;

[0008] In response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment to which the allowed domain name recorded in the first ACL rule belongs, the access request of the terminal is forwarded, wherein the first ACL rule is: the ACL rule in the configured ACL rules applied to the port accessed by the terminal.

[0009] Secondly, embodiments of the present invention provide an access request processing apparatus applied to a network device. The network device is configured with ACL rules specifying the ID of a micro-segment to which a domain name with specified access permissions belongs, and the configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. The apparatus includes:

[0010] A request receiving module is used to receive access requests from terminals accessing the network device for a first IP address;

[0011] The forwarding module is used to forward the access request of the terminal in response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment of the allowed domain name recorded in the first ACL rule. The first ACL rule is an ACL rule in the configured ACL rules applied to the port accessed by the terminal.

[0012] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0013] Memory, used to store computer programs;

[0014] When a processor executes a program stored in memory, it implements the steps of the method described in the first aspect.

[0015] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0016] Fifthly, embodiments of the present invention also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect.

[0017] As can be seen from the above, in the solution provided by the embodiments of the present invention, the network device is configured with ACL rules that specify the ID of the micro-segment to which the domain name with specified access permissions belongs, and the configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. Thus, after the network device receives the terminal's access request for the first IP address, if the packet forwarding unit determines that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment recorded in the first ACL rule applied to the terminal, it can forward the terminal's access request; otherwise, it ignores the access request, thereby realizing access control for the terminal.

[0018] In this approach, the network devices are configured with ACL rules based on micro-segment IDs. This means the ACL rules in the network devices are based on micro-segment IDs, and the underlying hardware uses these ACL rules, combined with the binding relationships in the routing table, to implement terminal access control. Compared to related technologies, this essentially transforms the matching object of ACL rules from specific IP addresses to the more abstract micro-segment IDs, achieving unified management of a class of IP addresses without needing to distribute access rules for each IP address to the packet forwarding unit. Therefore, even if the network device detects a change in the domain name's IP address, since the ACL rules based on the micro-segment IDs have not actually changed, there is no need to update the underlying hardware's ACL rules. In other words, the underlying hardware does not need to detect changes in the domain name's IP address. This saves the time spent updating hardware ACL rules when the domain name's IP address changes, avoiding the problem of the network device being unable to process access requests sent by terminals before the hardware ACL rules are updated. This improves access response speed and reliability, reduces stuttering when terminals access the network, and lowers latency. Especially when the IP address of a domain name changes frequently, the solution provided by this invention can significantly reduce the lag when a terminal accesses the network, significantly reduce the latency of the terminal accessing the network, improve the smoothness and stability of network access, and provide a guarantee for users' high-quality network access experience.

[0019] Furthermore, since the network device's processor does not need to issue new ACL rules for IP addresses to the packet forwarding unit, it saves the computing resources that the processor would otherwise spend issuing a large number of ACL rules to the underlying hardware, reducing the load on the processor and the underlying hardware. This allows the processor to allocate more resources to the main services, ensuring the stability of the main services in the network device.

[0020] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0022] Figure 1 This is a signaling diagram for an access request processing scenario in related technologies;

[0023] Figure 2 A flowchart illustrating an access request processing method provided in an embodiment of the present invention;

[0024] Figure 3 This is a flowchart illustrating a binding relationship update method provided in an embodiment of the present invention;

[0025] Figure 4 A signaling diagram for an access request processing scenario provided in an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of the structure of an access request processing device provided in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art based on the present invention are within the scope of protection of the present invention.

[0029] First, the application scenarios of the solutions provided in the embodiments of the present invention will be introduced.

[0030] The application scenario of the solution provided in this embodiment of the invention is: a scenario where access control of terminals is performed based on ACL rules configured in network devices such as routers and switches. Specifically, after configuring ACL rules in the network device, access permissions of terminals to network resources can be defined, such as defining the IP addresses that terminals are allowed to access and the IP addresses that are denied access to.

[0031] In some scenarios, ACL rules configured on network devices include access rules for specific domain names. In related technologies, the network device's processor needs to send access rules for each IP address corresponding to the aforementioned domain name to the packet forwarding unit; this process can be called sending ACL rules. Thus, when a terminal accessing the network device requests access to a certain IP address, the packet forwarding unit determines, based on the received access rules, whether the terminal has the necessary access permissions for that IP address. If so, the terminal's access request is forwarded; otherwise, forwarding is rejected. The packet forwarding unit specifically refers to the forwarding chip in the network device, which can also be referred to as the underlying hardware elsewhere in this document.

[0032] However, the IP addresses corresponding to domain names are prone to change. When the IP addresses of domain names change, the access rules also change. Therefore, the processor needs to send updated ACL rules to the packet forwarding unit. If the number of domain names with changing IP addresses or the number of changing IP addresses is large, the amount of ACL rule data that the processor needs to send is substantial, which can easily lead to message backlog and thus prolonged processing time. If the aforementioned access rules have not yet been sent when a terminal requests access to a certain IP address, the packet forwarding unit cannot process the access request immediately but must wait for the rules to be sent, resulting in high latency for the terminal's network access.

[0033] The following is through Figure 1 To provide a more intuitive explanation of the above situation.

[0034] like Figure 1 As shown, in step S101, the network device detects that the IP address corresponding to the domain name in the access control list (ACL) rules configured for the terminal has changed. Then, it triggers step S102 to start sending the updated ACL rules to the packet forwarding unit. Next, as shown in step S103, the terminal applying the above ACL rules sends an access request to the network device. At this time, for the packet forwarding unit, since the updated ACL rules have not yet been sent, the network device cannot process the above access request. Subsequently, as shown in steps S104-S105, the network device needs to wait for the ACL rules to be sent before processing the access request based on the updated ACL rules.

[0035] As can be clearly seen from the above, the time required for a network device to issue updated ACL rules is relatively long. Consequently, the latency between the terminal sending an access request to the network device and the network device processing the access request based on the updated ACL rules is high, resulting in latency and stuttering when the terminal accesses the network.

[0036] In view of the above, embodiments of the present invention provide a message forwarding scheme to reduce the latency of terminal network access.

[0037] First, the overall concept and general process of the solution provided in the embodiments of the present invention will be introduced.

[0038] In the solution provided by the embodiments of the present invention, staff members pre-configure domain names with similar access permissions to be assigned to the same microsegment, so that they have the same microsegment ID.

[0039] Then, the binding relationship between the IP address corresponding to the domain name and the micro-segment ID is recorded locally on the network device.

[0040] For example, if domain names D1 and D2 are assigned microsegment ID1, and domain names D3 and D4 are assigned microsegment ID2, then the IP addresses of domain names D1 and D2 obtained through resolution are both bound to ID1; similarly, the IP addresses of domain names D3 and D4 obtained through resolution are both bound to ID2.

[0041] In one possible implementation, the binding relationship between the IP address and the micro-segment ID of the aforementioned domain name can be recorded in the hardware routing table maintained locally by the network device. This allows for convenient and quick updating of the binding relationship between the IP address and the micro-segment ID in the routing table should the IP address of the domain name change.

[0042] Next, the staff configures ACL rules for the micro-segment IDs in the network devices. These ACL rules are used to configure access permissions for the domains corresponding to the micro-segment IDs. It can be seen that in the solution provided by this embodiment of the invention, the granularity of the configured ACL rules is the micro-segment ID. This will be illustrated below with specific code examples.

[0043] For example, the code statement for configuring ACL rules for a micro-segment ID can be:

[0044] rule 0permit ip destination microsegment 1.

[0045] Here, 1 represents the ID of the microsegment, and the above code indicates that access is allowed to the IP address bound to the microsegment ID1.

[0046] Of course, the above code statements are only illustrative for ease of understanding and do not constitute a limitation on the embodiments of the present invention. Staff can flexibly set various configuration codes according to actual scenario requirements.

[0047] Finally, the processor in the network device synchronizes the aforementioned ACL rules to the packet forwarding unit. Thus, when a terminal requests access to a specific IP address, if the packet forwarding unit determines, based on the recorded binding relationships, that the IP address requested by the terminal has already established a binding relationship with micro-segment ID1, then the terminal is considered to have permission to access the aforementioned IP address; otherwise, the terminal is considered not to have permission to access the aforementioned IP address.

[0048] As can be seen, in the solution provided by this embodiment of the invention, it is not necessary to send access rules for each IP address to the packet forwarding unit. Therefore, even if the network device detects a change in the IP address of the domain name, it does not need to send new ACL rules for the IP address to the packet forwarding unit, that is, it does not need to update the ACL rules in the underlying hardware. This saves the time required to update hardware ACL rules, avoids the problem of not being able to process access requests sent by the terminal during the hardware ACL update process, reduces the stuttering phenomenon when the terminal accesses the network, and also reduces the latency of the terminal accessing the network.

[0049] The following flowchart will provide a detailed description of the access request processing scheme provided in the embodiments of the present invention.

[0050] See Figure 2 The above is a flowchart illustrating the first access request processing method provided in the embodiment of the present invention. The method is applied to a network device. The network device is configured with ACL rules that specify the ID of the micro-segment to which the domain name with specified access permissions belongs. The configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. The method includes the following steps S201-S202.

[0051] Step S201: Receive an access request from a terminal accessing the network device for the first IP address.

[0052] The first IP address mentioned above is also the IP address of the domain name that the terminal expects to access.

[0053] Specifically, when a user triggers an operation request to access a domain name on the terminal interface, the terminal will send an access request for the IP address of the domain name to be accessed to the network device. The following describes several specific situations when the terminal sends the first IP address.

[0054] Scenario 1: The terminal's local cache contains the IP address of the domain name to be accessed.

[0055] In this case, if there is only one cached IP address for the domain name to be accessed, the terminal directly sends an access request for that IP address to the network device; if there are multiple cached IP addresses for the domain name to be accessed, the terminal selects one of them and then sends an access request for that IP address to the network device.

[0056] Scenario 2: The terminal does not cache the IP address of the domain name to be accessed locally, or the cached IP address has expired.

[0057] In this scenario, the terminal first sends a DNS resolution request for the domain name to be accessed to the network device. Upon receiving this request, the network device forwards it to the Domain Name System (DNS) server via network packet forwarding. The DNS server resolves the IP address of the domain name to be accessed and then forwards it back to the network device via network packet forwarding. The network device then notifies the terminal of this IP address, allowing the terminal to send an access request to the network device based on the received IP address. The method by which the terminal sends an access request to the network device based on the received IP address is similar to the previous scenario: if only one IP address is received, the terminal directly sends an access request for that IP address; if multiple IP addresses are received, the terminal selects one and sends an access request for that IP address to the network device.

[0058] Step S202: In response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment to which the allowed domain name recorded in the first ACL rule belongs, the terminal's access request is forwarded.

[0059] The first ACL rule is the ACL rule that is applied to the port accessed by the terminal in the configured ACL rules. In other words, it is the ACL rule applied to the terminal and used to control access to the terminal.

[0060] Specifically, after receiving an access request for the first IP address, the network device can match the micro-segment ID corresponding to the first IP address from the recorded binding relationships. Depending on whether a micro-segment ID is matched, the following situations apply:

[0061] If a micro-segment ID is matched, it can be determined whether the matched micro-segment ID belongs to the micro-segment ID recorded in the first ACL rule. If the result is yes, it means that the domain name to which the first IP address belongs is a domain name that the terminal is allowed to access, so the terminal's access request can be forwarded. Otherwise, it means that the domain name to which the first IP address belongs is a domain name that the terminal is allowed to access, so the terminal's access request is ignored.

[0062] If no micro-segment ID is matched, it means that the domain name to which the first IP address belongs has not been configured with a micro-segment ID. In other words, the domain name to which the first IP address belongs is not a domain name that is of interest when performing access control. Therefore, it can be directly assumed that the first IP address does not belong to the IP address of a domain name that is allowed for terminal access, and the terminal's access request is ignored.

[0063] As can be seen from the above, in the solution provided by the embodiments of the present invention, the network device is configured with ACL rules that specify the ID of the micro-segment to which the domain name with specified access permissions belongs, and the configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. Thus, after the network device receives the terminal's access request for the first IP address, if the packet forwarding unit determines that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment recorded in the first ACL rule applied to the terminal, it can forward the terminal's access request; otherwise, it ignores the access request, thereby realizing access control for the terminal.

[0064] In this approach, the network devices are configured with ACL rules based on micro-segment IDs. This means the ACL rules in the network devices are based on micro-segment IDs, and the underlying hardware uses these ACL rules, combined with the binding relationships in the routing table, to implement terminal access control. Compared to related technologies, this essentially transforms the matching object of ACL rules from specific IP addresses to the more abstract micro-segment IDs, achieving unified management of a class of IP addresses without needing to distribute access rules for each IP address to the packet forwarding unit. Therefore, even if the network device detects a change in the domain name's IP address, since the ACL rules based on the micro-segment IDs have not actually changed, there is no need to update the underlying hardware's ACL rules. In other words, the underlying hardware does not need to detect changes in the domain name's IP address. This saves the time spent updating hardware ACL rules when the domain name's IP address changes, avoiding the problem of the network device being unable to process access requests sent by terminals before the hardware ACL rules are updated. This improves access response speed and reliability, reduces stuttering when terminals access the network, and lowers latency. Especially when the IP address of a domain name changes frequently, the solution provided by this invention can significantly reduce the lag when a terminal accesses the network, significantly reduce the latency of the terminal accessing the network, improve the smoothness and stability of network access, and provide a guarantee for users' high-quality network access experience.

[0065] Furthermore, since the network device's processor does not need to issue new ACL rules for IP addresses to the packet forwarding unit, it saves the computing resources that the processor would otherwise spend issuing a large number of ACL rules to the underlying hardware, reducing the load on the processor and the underlying hardware. This allows the processor to allocate more resources to the main services, ensuring the stability of the main services in the network device.

[0066] In one possible implementation, staff can configure domains that meet access permission requirements to belong to the same micro-segment.

[0067] The access permission conditions mentioned above can be that the accessed devices have the same permissions. For example, domains that allow access from the same group of terminals can be grouped into the same micro-segment, or domains that deny access from the same group of terminals can be grouped into the same micro-segment. This simplifies subsequent ACL rule configuration and improves the rationality of the solution.

[0068] In one possible implementation, the network device can delete the binding relationship and record the new binding relationship between the IP address of the domain name with configured access permissions and the ID of the changed micro-segment if it determines that the micro-segment to which the domain name with configured access permissions belongs has changed.

[0069] It should be noted that in this case, since the micro-segment to which the domain belongs has changed, staff can determine whether it is necessary to adjust the ACL rules based on the actual situation.

[0070] If the micro-segment to which a domain with configured access permissions belongs changes, the original binding relationship becomes invalid. Therefore, the original binding relationship can be destroyed and a new binding relationship can be established, thereby improving the accuracy of access control for terminals based on the binding relationship.

[0071] In one possible implementation, the network device may also respond to the authentication request sent by the terminal and authenticate the terminal; after determining that the terminal has passed the authentication, it may notify the packet forwarding unit of the authentication result, so that the packet forwarding unit can process the terminal's access request after receiving the authentication result.

[0072] exist Figure 2 Based on the illustrated embodiment, the network device can also re-resolve domain names with configured access permissions in the ACL rules when the domain name resolution conditions are met, and update the established binding relationship based on the resolved IP address. In view of the above, this embodiment of the invention provides a binding relationship update method.

[0073] See Figure 3 The above is a flowchart of a binding relationship update method provided by an embodiment of the present invention. The method includes the following steps S301-S303.

[0074] Step S301: In response to the satisfaction of the domain name resolution conditions, obtain the IP address obtained by resolving the domain name with configured access permissions.

[0075] In other words, once the network device determines that the domain name resolution conditions are met, it will resolve the domain names for which access permissions are specified in the ACL rules.

[0076] There can be multiple domain name resolution conditions, and examples are given below.

[0077] For example, the aforementioned domain name resolution conditions could be: the network device determines the time to reach the domain name resolution based on the set domain name resolution interval and the previous domain name resolution time. The aforementioned domain name resolution interval can be set by staff according to the actual needs of the scenario.

[0078] In this scenario, network devices continuously sense changes in domain names at a certain frequency, which helps to promptly detect changes in the domain name's IP address, allowing for timely updates to the binding relationship when a change in the domain name's IP address is detected.

[0079] For example, the above domain name resolution condition could be: the network device receives a resolution request from the terminal for a domain name with configured access permissions.

[0080] As explained earlier, when the IP address of a cached domain name on a terminal expires, it sends a domain name resolution request to the network device. Upon receiving this request, the network device triggers the domain name resolution process. Therefore, when the network device receives a resolution request from the terminal for a domain name with configured access permissions, it will trigger the resolution process for that domain name.

[0081] In this scenario, after resolving the domain name, the network device can also perform subsequent IP address change checks, updating the binding relationship once it confirms that the IP address of a domain with configured access permissions has changed. It is evident that the network device can not only proactively and periodically detect IP address changes of domains with configured access permissions and update the binding relationship upon detection, but also trigger domain name resolution based on user requests, updating the binding relationship upon confirmation of an IP address change. This allows for a more comprehensive and accurate detection of domain name IP address changes, improving the timeliness of binding relationship updates.

[0082] Step S302: Based on the obtained IP address and the IP address in the binding relationship, determine whether the IP address of the domain name with configured access permissions has changed. If yes, proceed to step S303.

[0083] Specifically, network devices can compare the IP address obtained after resolving the domain name with the IP address in the established binding relationship. If they are the same, it is determined that the IP address of the domain name with configured access permissions has not changed; otherwise, it is determined that the IP address of the domain name with configured access permissions has changed.

[0084] Step S303: Update the binding relationship based on the obtained IP address.

[0085] After learning that a domain's IP address has changed, network devices can update the binding relationship based on the obtained IP address using the following methods:

[0086] In one implementation, the network device can compare the obtained IP address with the IP address in the binding relationship, determine the change IP address of the domain name with configured access permissions based on the comparison result, and then update the binding relationship based on the change IP address.

[0087] The aforementioned IP address changes include: adding new IP addresses and / or invalidating IP addresses.

[0088] Among them, newly added IP addresses are IP addresses that exist in the obtained IP addresses but do not exist in the binding relationship; specifically, they are newly added IP addresses for the domain name. Expired IP addresses are IP addresses that exist in the binding relationship but do not exist in the obtained IP addresses; specifically, they are expired IP addresses for the domain name.

[0089] Specifically, for newly added IP addresses, a binding relationship can be created between the newly added IP address and the micro-segment ID to which the domain belongs in the binding relationship; for expired IP addresses, the binding relationship between the expired IP address and the micro-segment ID to which the domain belongs can be removed in the binding relationship.

[0090] This method is suitable for situations where a large number of IP addresses are obtained. In this case, the binding relationship is updated only for newly added IP addresses and / or expired IP addresses. That is, the binding relationship is updated incrementally, which reduces the computing resources required to update the binding relationship.

[0091] In another implementation, the binding relationship can be directly broken, and a binding relationship can be established between the obtained IP addresses and the IDs of the micro-segments to which the domains with configured access permissions belong. This method is suitable when the number of obtained IP addresses is small, in which case the computational resources required to establish binding relationships between all obtained IP addresses and the IDs of the micro-segments to which the domains with configured access permissions belong are relatively small.

[0092] In this way, network devices can re-resolve domain names when they determine that the domain name resolution conditions are met, thereby continuously sensing changes in the IP address of the domain name and updating the binding relationship when a change in the IP address is detected, ensuring the accuracy of subsequent access control.

[0093] Based on the foregoing embodiments, the following section will use a signaling diagram to describe an access request processing flow provided by an embodiment of the present invention.

[0094] See Figure 4 This is a signaling diagram of an access request processing flow provided in an embodiment of the present invention. The flow includes the following steps S401-S404.

[0095] Step S401: The network device detects that the IP address corresponding to the domain name in the configured ACL rule has changed.

[0096] Step S402: The network device updates the binding relationship between IP address and micro-segment ID in the routing table.

[0097] Step S403: The terminal sends an access request to the network device.

[0098] Step S404: The network device processes the access request based on the updated binding relationship.

[0099] By comparison Figure 1 In the related technologies shown, the access request processing scenario can be seen that...

[0100] In related technologies, after a domain's IP address changes, updated ACL rules for each IP address need to be sent to the underlying hardware. The process from the start of sending the ACL rules to completion is lengthy, and terminal requests cannot be processed until the sending is complete. Consequently, this results in access lag and high latency for the terminal.

[0101] In the solution provided by this invention, the network device is configured with ACL rules for the micro-segment ID. The underlying hardware implements terminal access control based on these ACL rules for the micro-segment ID combined with the binding relationships in the routing table. Thus, when the network device detects a change in the IP address of a domain name, the ACL rules for the micro-segment ID do not actually change. Therefore, there is no need to update the ACL rules of the underlying hardware; only the binding relationships in the routing table need to be updated. Updating the binding relationships in the routing table takes less time, and the terminal's access request can be processed immediately after the update. This results in lower latency for the network device in processing terminal requests, reducing stuttering and latency when the terminal accesses the network. Especially when the IP address of a domain name changes frequently, the solution provided by this invention, compared to related technologies, eliminates the need for frequent updates to the ACL rules in the underlying hardware, significantly reducing stuttering and latency when the terminal accesses the network, thus ensuring a better network access experience for users.

[0102] Corresponding to the above-described access request processing method, this embodiment of the invention also provides an access request processing apparatus.

[0103] See Figure 5 This is a schematic diagram of an access request processing device provided in an embodiment of the present invention. The device is applied to a network device, which is configured with ACL rules specifying the ID of the micro-segment to which the domain name with specified access permissions belongs. The configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. The device includes the following modules:

[0104] The request receiving module 501 is used to receive an access request from a terminal accessing the network device for a first IP address;

[0105] The forwarding module 502 is used to forward the access request of the terminal in response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment of the allowed domain name recorded in the first ACL rule. The first ACL rule is an ACL rule in the configured ACL rules applied to the port accessed by the terminal.

[0106] As can be seen from the above, in the solution provided by the embodiments of the present invention, the network device is configured with ACL rules that specify the ID of the micro-segment to which the domain name with specified access permissions belongs, and the configured ACL rules record the binding relationship between the IP address of the domain name with specified access permissions and the ID of the micro-segment. Thus, after the network device receives the terminal's access request for the first IP address, if the packet forwarding unit determines that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment recorded in the first ACL rule applied to the terminal, it can forward the terminal's access request; otherwise, it ignores the access request, thereby realizing access control for the terminal.

[0107] In this approach, the network device is configured with ACL rules based on micro-segment IDs. This means the ACL rules in the network device are based on micro-segment IDs, and the underlying hardware uses these ACL rules, combined with the binding relationships in the routing table, to implement terminal access control. Compared to related technologies, this essentially transforms the matching object of ACL rules from specific IP addresses to the more abstract micro-segment IDs, achieving unified management of a class of IP addresses without needing to distribute access rules for each IP address to the packet forwarding unit. Therefore, even if the network device detects a change in the domain name's IP address, since the ACL rules based on the micro-segment IDs have not actually changed, there is no need to update the underlying hardware's ACL rules. In other words, the underlying hardware does not need to detect changes in the domain name's IP address. This saves the time spent updating hardware ACL rules when the domain name's IP address changes, avoiding the problem of the network device being unable to process access requests sent by terminals before the hardware ACL rules are updated. This improves access response speed and reliability, reduces stuttering when terminals access the network, and lowers latency. Especially when the IP address of a domain name changes frequently, the solution provided by this invention can significantly reduce the lag when a terminal accesses the network, significantly reduce the latency of the terminal accessing the network, improve the smoothness and stability of network access, and provide a guarantee for users' high-quality network access experience.

[0108] Furthermore, since the network device's processor does not need to issue new ACL rules for IP addresses to the packet forwarding unit, it saves the computing resources that the processor would otherwise spend issuing a large number of ACL rules to the underlying hardware, reducing the load on the processor and the underlying hardware. This allows the processor to allocate more resources to the main services, ensuring the stability of the main services in the network device.

[0109] In one embodiment of the present invention, the apparatus further includes:

[0110] The IP address acquisition module is used to obtain the IP address obtained by resolving the domain name with the specified access permissions in response to the domain name resolution conditions being met.

[0111] The judgment module is used to determine whether the IP address of the domain name with specified access permissions has changed based on the obtained IP address and the IP address in the binding relationship. If so, the first update module is triggered.

[0112] The first update module is used to update the binding relationship based on the obtained IP address.

[0113] In this way, network devices can re-resolve domain names when they determine that the domain name resolution conditions are met, thereby continuously sensing changes in the IP address of the domain name and updating the binding relationship when a change in the IP address is detected, ensuring the accuracy of subsequent access control.

[0114] In one embodiment of the present invention, the domain name resolution conditions include at least one of the following conditions:

[0115] The arrival time for domain name resolution is determined based on the set domain name resolution interval and the previous domain name resolution time;

[0116] Received a DNS resolution request from the terminal for the domain name for which access permissions have been specified.

[0117] In this scenario, network devices continuously monitor domain name changes at a certain frequency, which helps to promptly detect changes in the domain's IP address. This allows for timely updates to the binding relationship when a change in the domain's IP address is detected. Furthermore, network devices can not only proactively and periodically monitor IP address changes for domains with configured access permissions and update the binding relationship upon detection, but also trigger domain name resolution based on user requests, updating the binding relationship only after confirming an IP address change. This provides a more comprehensive and accurate understanding of domain IP address changes, improving the timeliness of binding relationship updates.

[0118] In one embodiment of the present invention, the first update module is specifically used to compare the obtained IP address with the IP address in the binding relationship, determine the changed IP address of the domain name with specified access permissions based on the comparison result, the changed IP address includes: adding an IP address and / or invalidating an IP address, and update the binding relationship based on the changed IP address.

[0119] This method is suitable for situations where a large number of IP addresses are obtained. In this case, the binding relationship is updated only for newly added IP addresses and / or expired IP addresses. That is, the binding relationship is updated incrementally, which reduces the computing resources required to update the binding relationship.

[0120] In one embodiment of the present invention, the first update module is specifically used to directly unbind the binding relationship and establish a binding relationship between the obtained IP address and the ID of the micro-segment to which the domain name with specified access permissions belongs.

[0121] This method is suitable for situations where the number of obtained IP addresses is small. In such cases, establishing the binding relationship between all obtained IP addresses and the ID of the micro-segment to which the domain name with configured access permissions belongs requires less computational resources.

[0122] In one embodiment of the present invention, domain names that satisfy the access permission conditions belong to the same micro-segment.

[0123] This makes subsequent ACL rule configuration more convenient and improves the rationality of the solution.

[0124] In one embodiment of the present invention, the apparatus further includes:

[0125] The second update module is used to delete the binding relationship and record the new binding relationship between the IP address of the domain name with the specified access permissions and the ID of the changed micro-segment when it is determined that the micro-segment to which the domain name with the specified access permissions belongs has changed.

[0126] If the micro-segment to which a domain with configured access permissions belongs changes, the original binding relationship becomes invalid. Therefore, the original binding relationship can be destroyed and a new binding relationship can be established, thereby improving the accuracy of access control for terminals based on the binding relationship.

[0127] In one embodiment of the present invention, the binding relationship is recorded in a locally maintained routing table.

[0128] In this way, when the IP address of a domain name changes, the binding relationship between the domain name's IP address and the micro-segment ID can be updated easily and quickly in the routing table.

[0129] Corresponding to the above-described access request processing method, embodiments of the present invention also provide an electronic device, a computer-readable storage medium, and a computer program.

[0130] This invention provides an electronic device, such as... Figure 6 As shown, it includes:

[0131] Memory 601 is used to store computer programs;

[0132] The processor 602, when executing a program stored in the memory 601, implements the aforementioned access request processing method.

[0133] Furthermore, the aforementioned electronic device may also include a communication bus and / or a communication interface, with the processor 602, communication interface, and memory 601 communicating with each other via the communication bus.

[0134] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0135] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0136] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0137] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0138] In another embodiment of the present invention, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of the access request processing method described above.

[0139] In another embodiment of the present invention, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the access request processing methods described in the above embodiments.

[0140] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a solid-state drive (SSD), etc.

[0141] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0142] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, electronic devices, and storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0143] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. An access request processing method, characterized in that, The method, applied to network devices, is configured with Access Control List (ACL) rules specifying the IDs of micro-segments to which domain names with defined access permissions belong. The configured ACL rules record the binding relationship between the IP addresses of the domain names with defined access permissions and the IDs of the micro-segments. Receive an access request from a terminal accessing the network device for a first IP address; In response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment to which the allowed domain name recorded in the first ACL rule belongs, the access request of the terminal is forwarded, wherein the first ACL rule is: the ACL rule in the configured ACL rules applied to the port accessed by the terminal.

2. The method according to claim 1, characterized in that, The method further includes: In response to meeting the domain name resolution conditions, obtain the IP address obtained by resolving the domain name with the specified access permissions; Based on the obtained IP address and the IP address in the binding relationship, determine whether the IP address of the domain name with specified access permissions has changed; If so, update the binding relationship based on the obtained IP address.

3. The method according to claim 2, characterized in that, The domain name resolution conditions include at least one of the following conditions: The arrival time for domain name resolution is determined based on the set domain name resolution interval and the previous domain name resolution time; Received a DNS resolution request from the terminal for the domain name for which access permissions have been specified.

4. The method according to claim 2, characterized in that, Updating the binding relationship based on the obtained IP address includes: By comparing the obtained IP address with the IP address in the binding relationship, the changed IP address of the domain name with specified access permissions is determined based on the comparison result. The changed IP address includes: adding an IP address and / or invalidating an IP address. Based on the changed IP address, the binding relationship is updated. or The binding relationship is directly terminated, and a binding relationship is established between the obtained IP address and the ID of the micro-segment to which the domain name with specified access permissions belongs.

5. The method according to claim 1, characterized in that, Domains that meet the access permission requirements belong to the same micro-segment.

6. The method according to any one of claims 1-5, characterized in that, The method further includes: If it is determined that the micro-segment to which the domain name with specified access permissions belongs has changed, the binding relationship is deleted, and a new binding relationship between the IP address of the domain name with specified access permissions and the ID of the changed micro-segment is recorded.

7. The method according to any one of claims 1-5, characterized in that, The binding relationship is recorded in the locally maintained routing table.

8. An access request processing apparatus, characterized in that, An ACL rule, applicable to network devices, is configured with ACL rules specifying the IDs of micro-segments to which domain names with defined access permissions belong. The configured ACL rules record the binding relationship between the IP addresses of the domain names with defined access permissions and the IDs of the micro-segments. The device includes: A request receiving module is used to receive access requests from terminals accessing the network device for a first IP address; The forwarding module is used to forward the access request of the terminal in response to the packet forwarding unit in the network device determining that the ID of the first micro-segment bound to the first IP address belongs to the ID of the micro-segment of the allowed domain name recorded in the first ACL rule. The first ACL rule is an ACL rule in the configured ACL rules applied to the port accessed by the terminal.

9. The apparatus according to claim 8, characterized in that, The device further includes: The IP address acquisition module is used to obtain the IP address obtained by resolving the domain name with the specified access permissions in response to the domain name resolution conditions being met. The judgment module is used to determine whether the IP address of the domain name with specified access permissions has changed based on the obtained IP address and the IP address in the binding relationship. If so, the first update module is triggered. The first update module is used to update the binding relationship based on the obtained IP address.

10. The apparatus according to claim 9, characterized in that, The domain name resolution conditions include at least one of the following conditions: The arrival time for domain name resolution is determined based on the set domain name resolution interval and the previous domain name resolution time; Received a DNS resolution request from the terminal for the domain name for which access permissions have been specified.

11. The apparatus according to claim 9, characterized in that, The first update module is specifically used to compare the obtained IP address with the IP address in the binding relationship, and determine the changed IP address of the domain name with specified access permissions based on the comparison result. The changed IP address includes: adding an IP address and / or invalidating an IP address. Based on the changed IP address, the binding relationship is updated; or, the binding relationship is directly released, and a binding relationship is established between the obtained IP address and the ID of the micro-segment to which the domain name with specified access permissions belongs.

12. The apparatus according to claim 8, characterized in that, Domains that meet the access permission requirements belong to the same micro-segment.

13. The apparatus according to any one of claims 8-12, characterized in that, The device further includes: The second update module is used to delete the binding relationship and record the new binding relationship between the IP address of the domain name with the specified access permissions and the ID of the changed micro-segment when it is determined that the micro-segment to which the domain name with the specified access permissions belongs has changed.

14. The apparatus according to any one of claims 8-12, characterized in that, The binding relationship is recorded in the locally maintained routing table.

15. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1 to 7.

Images