Cloud gateway access method and system, electronic equipment, storage medium and product

Abstract

The invention provides a cloud gateway access method and system, electronic equipment, a storage medium and a product, which are applied to local gateway equipment and comprise the following steps: determining an application category label of a service message; if the application type label of the service message is a value-added service type label, packaging the service message based on the application type label to obtain a value-added service packaging message; forwarding the value added service packaging message to a cloud gateway device; the application category label packaged in the value added service packaging message is used for determining the corresponding service application. According to the embodiment of the invention, the application category label of the service message is determined at the local gateway side, and the value-added service type and the basic internet surfing type are distinguished, so that the value-added service message flow can be clouded; the cloud gateway can directly forward the received value-added service message flow to the corresponding service application for processing based on the specific application category label determined by the local gateway equipment, thereby realizing timely forwarding of the message at the cloud gateway side, and improving the value-added service processing efficiency.

Description

Technical Field

[0001] This invention relates to the field of cloud gateway technology, and in particular to a cloud gateway access method, system, electronic device, storage medium, and product. Background Technology

[0002] Against the backdrop of network construction, the scale and consumer demand of the cloud terminal industry are showing a year-on-year increasing trend. By decoupling software and hardware, cloud terminals can migrate computing resources to the cloud, forming a trend of software cloudification + thin hardware clients, thereby achieving flexible expansion of terminal performance.

[0003] Currently, all traffic from the local gateway can be routed to the cloud by encapsulating a Virtual Extensible Local Area Network (VxLAN) tunnel within the local gateway. However, this requires the cloud side to first distinguish between different value-added service types of the packet traffic before forwarding the packets. This approach cannot promptly forward the packet traffic to the corresponding business applications for processing, resulting in reduced efficiency in value-added service processing. Summary of the Invention

[0004] This invention provides a cloud gateway access method, system, electronic device, storage medium, and product to address the shortcomings of existing technologies that require differentiating message traffic for different value-added service types on the cloud side, and cannot promptly forward received message traffic to the corresponding business applications for processing, resulting in reduced value-added service processing efficiency. The invention enables value-added service message traffic to be uploaded to the cloud, and achieves timely forwarding of messages on the cloud gateway side based on specific application category tags determined by the local gateway device, thereby improving the efficiency of value-added service processing.

[0005] This invention provides a cloud gateway access method, applied to a local gateway device, comprising: Determine the application category label for the business message; If the application category label of the service message is a value-added service type label, then the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message. The value-added service encapsulated message is forwarded to the cloud gateway device; the application category tag encapsulated in the value-added service encapsulated message is used to identify the corresponding service application.

[0006] According to a cloud gateway access method provided by the present invention, the step of encapsulating the service message based on the application category tag to obtain a value-added service encapsulated message includes: Based on the application category label, the service message is encapsulated using IPv6 VxLAN to obtain a value-added service encapsulated message. The value-added service encapsulation message is further divided into an inner layer encapsulating the service message, an outer layer encapsulating an IPv6 VxLAN message, and an outermost layer encapsulating a PPPoE (Point-to-Point Protocol over Ethernet) header. The IPv6 header option extension field of the IPv6 VxLAN message encapsulates the application category label, the cloud gateway device identifier, a first XOR value of the application category label, a first OR value of the cloud gateway device identifier and the application category label, and a first hash value. The first hash value is obtained by performing a hash operation based on the first XOR value, the first OR value, and the application category label.

[0007] According to a cloud gateway access method provided by the present invention, the IPv6 header option extension field of the value-added service encapsulation message is encapsulated with a trusted label. The trusted label includes a cloud gateway device identifier, a VxLAN tunnel identifier, a key value, a second XOR value and a second hash value of the cloud gateway device identifier and the VxLAN network; the second hash value is obtained by hashing the second XOR value, the cloud gateway device identifier, the VxLAN tunnel identifier and the key value.

[0008] According to a cloud gateway access method provided by the present invention, determining the application category tag of the service message includes: Identify untagged service messages; If the domain name and destination IP in the service message match the configuration rules issued by the controller, then based on the application category tag mapping table, the five-tuple session table corresponding to the service message is tagged with an application category tag to obtain a tag-tagged session flow table. When forwarding packets, the application category label of the service packet is determined based on the session flow table marked by the label.

[0009] This invention also provides another cloud gateway access method, applied to a cloud gateway device, comprising: Receive a value-added service encapsulation message sent by a local gateway device; the value-added service encapsulation message is obtained by encapsulating the service message based on the application category tag when the application category tag of the service message is a value-added service type tag; The value-added service encapsulated message is parsed to obtain the service message; Based on the association between application category tags and business applications, the business message is forwarded to the business application corresponding to the application category tag.

[0010] According to another cloud gateway access method provided by the present invention, the IPv6 header option extension field of the value-added service encapsulation message encapsulates an application category tag, a cloud gateway device identifier and a third XOR value of the application category tag, a second OR value of the cloud gateway device identifier and the application category tag, and a third hash value; parsing the value-added service encapsulation message to obtain the service message includes: The third XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the application category label; A fourth hash value is calculated based on the application category tag, the fourth XOR value of the application category tag and the locally configured cloud gateway device identifier, and the third OR value of the application category tag and the locally configured cloud gateway device identifier. Based on the comparison result between the third hash value and the fourth hash value, the application category label validity verification result is determined; If the application category label validity verification result is successful, the value-added service encapsulated message is parsed to obtain the service message.

[0011] According to another cloud gateway access method provided by the present invention, the IPv6 header option extension field of the value-added service encapsulation message is encapsulated with a trusted label, the trusted label including a cloud gateway device identifier, a VxLAN tunnel identifier, a key value, the cloud gateway device identifier, and the fifth XOR value and fifth hash value of the VxLAN network; parsing the value-added service encapsulation message to obtain the service message includes: The fifth XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the VxLAN tunnel identifier; A hash operation is performed based on the VxLAN tunnel identifier, the locally configured cloud gateway device identifier, the key value, and the sixth XOR value of the VxLAN tunnel identifier and the locally configured cloud gateway device identifier to obtain the sixth hash value; Based on the comparison result between the fifth hash value and the sixth hash value, the validity verification result of the local gateway device is determined; If the validity verification result of the local gateway device is successful, the value-added service encapsulated message is parsed to obtain the service message.

[0012] The present invention also provides a cloud gateway access system, comprising: The local gateway device is used to determine the application category label of the service message; if the application category label of the service message is a value-added service type label, the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message; and the value-added service encapsulated message is forwarded to the cloud gateway device. The cloud gateway device is used to parse the value-added service encapsulation message to obtain the service message; based on the association between the application category tag and the service application, the service message is forwarded to the service application corresponding to the application category tag.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the cloud gateway access methods described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cloud gateway access method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the cloud gateway access method as described above.

[0016] The cloud gateway access method, system, electronic device, storage medium, and product provided by this invention determine the application category label of the service message on the local gateway device side. If the application category label of the service message is a value-added service type label, the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message, and the value-added service encapsulated message is forwarded to the cloud gateway device. Thus, based on the distinction between value-added service type and basic internet access type, value-added service message traffic can be uploaded to the cloud. The cloud gateway can directly forward the received value-added service message traffic to the corresponding service application for processing based on the specific application category label determined by the local gateway device, realizing timely forwarding of messages on the cloud gateway side and improving the efficiency of value-added service processing. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is one of the flowcharts illustrating the cloud gateway access method provided in this embodiment of the invention.

[0019] Figure 2 This is the second flowchart of the cloud gateway access method provided in this embodiment of the invention.

[0020] Figure 3 This is a schematic diagram of the architecture of the cloud gateway access method provided in an embodiment of the present invention.

[0021] Figure 4 This is a schematic diagram of the cloud gateway access system provided in an embodiment of the present invention.

[0022] Figure 5 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0024] In the description of embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Those skilled in the art will understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0025] Figure 1 This is one of the flowcharts illustrating the cloud gateway access method provided in this embodiment of the invention. (Refer to...) Figure 1 This invention provides a cloud gateway access method, which may specifically include the following steps: Step 101: Determine the application category label of the business message.

[0026] The execution entity of the cloud gateway access method provided in this embodiment of the invention can be a local gateway device. A local gateway device can refer to a gateway device located within a local network or area, as opposed to a cloud gateway device. In the context of home broadband service applications, a local gateway device can refer to a home gateway device; the following embodiments of the invention use a home gateway device as an example for description.

[0027] In existing technologies, encapsulating VxLAN tunnels within home gateways to route all home gateway traffic to the cloud requires in-depth analysis on the cloud side to differentiate packet traffic into different service types before forwarding it to the corresponding application for processing. However, this approach increases the cloud's computational burden under high traffic conditions, impacting network performance and hindering the timely forwarding of received packet traffic to the appropriate application, thus reducing the efficiency of value-added service processing.

[0028] The execution entity of the cloud gateway access method provided in this embodiment of the invention can be a home gateway device. In this embodiment, the home gateway device can distinguish between value-added service types and basic internet access types for service packets, encapsulate application category tags belonging to value-added service types into the service packets, and forward the value-added service packet traffic to the cloud gateway device of the edge cloud, thereby enabling value-added service packet traffic to be uploaded to the cloud. After receiving the packet traffic, the cloud side can directly forward the received value-added service packet traffic to the corresponding service application for processing based on the specific application category tags determined by the home gateway device, thereby achieving timely forwarding of packets on the cloud gateway side and improving the efficiency of value-added service processing.

[0029] Specifically, the home gateway device can perform deep packet inspection (DPI) on service packets to identify application category quality labels in real time and populate the application category label information into the Destination Options Header (DOH) field of the service packet. Based on the application category label, the home gateway device can identify value-added services that need to be migrated to the cloud, establish an IPv6 VxLAN tunnel with the cloud gateway device, and realize the migration of value-added services to the cloud. The cloud gateway device can then intelligently schedule value-added services migrated to the cloud based on the association between the application type label of the service packet and the service application.

[0030] The application category tags can include initial value tags, basic internet access tags, education tags, game tags, cloud computing tags, etc.

[0031] Step 102: If the application category label of the service message is a value-added service type label, then the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message.

[0032] Specifically, if the application category tag of the service message belongs to the value-added service type tag, the application category tag information can be encapsulated in the DOH field of the IPv6 header of the service message to obtain the value-added service encapsulated message. The value-added service type tag can be an education tag, a gaming tag, a cloud computing tag, etc.

[0033] In some embodiments, if the application category label of the service message is a basic Internet access label, the service message can be encapsulated with Point-to-Point Protocol Over Ethernet (PPPOE) and the basic Internet access encapsulated message can be sent to the telecommunications data infrastructure network for processing without forwarding it to the cloud gateway device.

[0034] Step 103: Forward the value-added service encapsulated message to the cloud gateway device; the application category tag encapsulated in the value-added service encapsulated message is used to determine the corresponding service application.

[0035] Specifically, home gateway devices can forward value-added service encapsulated packets to cloud gateway devices through an IPv6 VxLAN tunnel established with cloud gateway devices, thereby enabling value-added services to be migrated to the cloud.

[0036] The cloud gateway device can parse the encapsulated messages of value-added services to obtain the service messages, and forward the service messages to the service applications corresponding to the application category tags based on the association between the application type tags and the service applications, thereby realizing intelligent scheduling for cloud-based value-added services.

[0037] This invention, through the local gateway device, determines the application category label of the service packet. If the application category label of the service packet is a value-added service type label, the service packet is encapsulated based on the application category label to obtain a value-added service encapsulated packet, which is then forwarded to the cloud gateway device. This allows value-added service packet traffic to be uploaded to the cloud based on the distinction between value-added service type and basic internet access type. The cloud gateway can directly forward the received value-added service packet traffic to the corresponding service application for processing based on the specific application category label determined by the local gateway device, achieving timely forwarding of packets on the cloud gateway side and improving the efficiency of value-added service processing.

[0038] Based on any of the above embodiments, the encapsulation of the service message based on the application category tag to obtain a value-added service encapsulated message includes: Based on the application category label, the service message is encapsulated using IPv6 VxLAN to obtain a value-added service encapsulated message. The value-added service encapsulation message is further divided into an inner layer encapsulating the service message, an outer layer encapsulating an IPv6 VxLAN message, and an outermost layer encapsulating a PPPoE (Point-to-Point Protocol over Ethernet) header. The IPv6 header option extension field of the IPv6 VxLAN message encapsulates the application category label, the cloud gateway device identifier, a first XOR value of the application category label, a first OR value of the cloud gateway device identifier and the application category label, and a first hash value. The first hash value is obtained by performing a hash operation based on the first XOR value, the first OR value, and the application category label.

[0039] In this embodiment of the invention, the inner layer of the value-added service encapsulation message can encapsulate a service message, the outer layer can encapsulate an IPv6 VxLAN message, wherein the IPv6 message header DOH field can encapsulate application category tag information, and the outermost layer can encapsulate a PPPoE message header. The encapsulation format of the value-added service encapsulation message can be referred to Table 1: Table 1

[0040] Specifically, in addition to the application category label, the DOH field in the IPv6 packet header can also be filled with a first XOR value obtained by XORing the Cloud Gateway Device ID (Identity Document, ID) and the application category label, a first OR value of the Cloud Gateway Device ID and the application category label, and a first hash value. The first hash value can be obtained by performing a hash operation based on the first XOR value, the first OR value, and the application category label.

[0041] As an example, the encryption field for the original application type label can be seen in Table 2: Table 2

[0042] In some embodiments, the inner layer of the Basic Internet Encapsulation (BIIE) message can encapsulate a Payload message body, and the outer layer can encapsulate a PPPoE message header. The encapsulation format of the BIIE message can be found in Table 3. Table 3

[0043] This invention enables tag encryption through the first XOR value of the cloud gateway device ID and the application category tag, and the first OR value of the cloud gateway device ID and the application category tag, thereby achieving secure identification and trusted access for the application category tag. By filling the encrypted application category tag into the DOH field of the IPv6 packet header, the cloud gateway device verifies the tag information based on the encrypted tag information, which can prevent the application category tag from being maliciously tampered with, causing low-priority services to use high-priority service tags and affecting service scheduling on the cloud gateway side.

[0044] Based on any of the above embodiments, the IPv6 header option extension field of the value-added service encapsulation message is encapsulated with a trusted label. The trusted label includes a cloud gateway device identifier, a VxLAN network identifier, a key value, a second XOR value and a second hash value of the cloud gateway device identifier and the VxLAN network. The second hash value is obtained by performing a hash operation based on the second XOR value, the cloud gateway device identifier, the VxLAN network identifier and the key value.

[0045] Specifically, the Remote Management System (RMS) can send VxLAN Network Identifier (VNI) information and key value KEY to the cloud gateway controller; the cloud gateway controller can send application category label mapping table, rule base, cloud gateway device ID, VNI and key value KEY to the home gateway device, and can also send application category label mapping table and key value KEY to the cloud gateway device.

[0046] Home gateway devices can encapsulate a trusted label in the DOH field of the IPv6 header of value-added service encapsulation messages. This label includes the cloud gateway device ID, VNI, key value, a second XOR value of the cloud gateway device ID and VNI, and a second hash value. The second hash value can be obtained by hashing the second XOR value, cloud gateway device ID, VNI, and key value. The second hash value can be represented as f(VNI^Cloud Gateway ID, VNI, Cloud Gateway ID, Key value KEY).

[0047] As an example, the fields encapsulated in the trusted label can be seen in Table 4: Table 4

[0048] As an example, the IPv6 header and extended fields can be seen in Table 5: Table 5 As an example, the IPv6 DOH field VNI encryption label and application category label can be found in Table 6: Table 6

[0049] This invention encapsulates a trusted label in the DOH field of the IPv6 packet header and sends the packet with the trusted label to the cloud gateway. The cloud gateway device then authenticates the home gateway device based on the trusted label information. This enables trusted access for home broadband users in a cloud gateway scenario, thereby achieving trusted access to value-added services and preventing non-cloud gateway home broadband users from accessing the cloud gateway device through a VxLAN tunnel.

[0050] Based on any of the above embodiments, determining the application category label of the service message includes: Identify untagged service messages; If the domain name and destination IP in the service message match the configuration rules issued by the controller, then based on the application category tag mapping table, the five-tuple session table corresponding to the service message is tagged with an application category tag to obtain a tag-tagged session flow table. When forwarding packets, the application category label of the service packet is determined based on the session flow table marked by the label.

[0051] Specifically, home gateway devices can be equipped with a DPI module. The home gateway device can send service packets without application category quality tags to the DPI module for application category tagging via mirroring. The DPI module can perform matching analysis based on the domain name in the Domain Name System (DNS) protocol of the service packet, the destination Internet Protocol (IP) address, and the configuration rules in the rule base issued by the controller. If a match is found, the application category tag can be marked on the five-tuple session table corresponding to the service packet based on the application category tag mapping table, and the session flow table can be synchronized to the forwarding module via memory sharing.

[0052] In some embodiments, the application category label mapping table can be referenced as shown in Table 7: Table 7

[0053] The application category label is a 6-digit number. The first two digits can represent the application category, such as normal internet access, education, gaming, or cloud computing (1xx represents normal internet access, 2xx represents education, 3xx represents gaming, and 4xx represents cloud computing). The middle two digits can represent latency (01 represents latency less than 1 millisecond, 02 represents latency less than 10 milliseconds, and 03 represents latency less than 100 milliseconds). The last two digits can represent throughput (01 represents 1 Mbps, 02 represents 10 Mbps, 03 represents 100 Mbps, and 04 represents 1000 Mbps).

[0054] When forwarding packets, the forwarding module can determine the application category label of the service packet based on the session flow table marked with tags. If the application category label of the service packet is a value-added service type label, such as education acceleration, game acceleration, cloud computing, etc., then the trusted access label and application category label can be encapsulated in the IPv6 DOH field, and the encapsulated value-added service packet can be forwarded to the cloud gateway device; if the application category label of the service packet is a basic internet access label, then it is forwarded normally to the telecommunications data infrastructure network.

[0055] In this embodiment of the invention, the application category tags are identified by a rule base issued by the cloud controller. The application category tags are identified in the DPI module, which can distinguish between value-added service types and basic network types, and realize the uploading of value-added service message traffic to the cloud. The cloud gateway device can directly forward the received value-added service message traffic to the corresponding business application for processing in a timely manner based on the specific application category tags of the value-added service messages, thereby improving the efficiency of value-added service processing.

[0056] Figure 2 This is the second flowchart illustrating the cloud gateway access method provided in this embodiment of the invention. (Refer to...) Figure 2 This invention provides a cloud gateway access method, which may specifically include the following steps: Step 201: Receive the value-added service encapsulation message sent by the local gateway device; the value-added service encapsulation message is obtained by encapsulating the service message based on the application category tag when the application category tag of the service message is the value-added service type tag.

[0057] In this embodiment of the invention, the local gateway device can distinguish between value-added service types and basic network types in service packets, encapsulate application category tags belonging to value-added service types into service packets, and forward value-added service packet traffic to the cloud gateway device of the edge cloud, thereby enabling value-added service packet traffic to be uploaded to the cloud.

[0058] After receiving the value-added service encapsulated message sent by the local gateway device, the cloud side can directly forward the received value-added service message traffic to the corresponding business application for processing based on the specific application category tag of the value-added service message, thereby improving the efficiency of value-added service processing.

[0059] Step 202: Parse the value-added service encapsulated message to obtain the service message.

[0060] Specifically, the cloud gateway device can verify the application category tag information carried in the value-added service encapsulation message based on the cloud gateway device ID configured locally by the controller and the encrypted application category tag information encapsulated in the DOH field of the IPv6 header of the value-added service encapsulation message.

[0061] Specifically, the cloud gateway device can also perform identity verification on the local gateway device based on the cloud gateway device ID configured locally by the controller and the trusted label information encapsulated in the DOH field of the IPv6 header of the value-added service encapsulation message.

[0062] If the application category tag information carried in the value-added service encapsulation message passes verification, and the identity verification of the local gateway device passes verification, the cloud gateway device can perform VxLAN parsing on the value-added service encapsulation message to obtain the original service message.

[0063] Step 203: Based on the association between the application category tag and the business application, forward the business message to the business application corresponding to the application category tag.

[0064] In this embodiment of the invention, the cloud gateway device can determine the association between application category tags and services based on the application category tag mapping table issued by the controller, thereby forwarding the parsed service messages to the service applications corresponding to the application category tags.

[0065] This invention, through the local gateway device, determines the application category label of the service packet. If the application category label of the service packet is a value-added service type label, the service packet is encapsulated based on the application category label to obtain a value-added service encapsulated packet, which is then forwarded to the cloud gateway device. This allows value-added service packet traffic to be uploaded to the cloud based on the distinction between value-added service type and basic internet access type. The cloud gateway can directly forward the received value-added service packet traffic to the corresponding service application for processing based on the specific application category label determined by the local gateway device, achieving timely forwarding of packets on the cloud gateway side and improving the efficiency of value-added service processing.

[0066] Based on any of the above embodiments, the IPv6 header option extension field of the value-added service encapsulated message encapsulates an application category tag, a cloud gateway device identifier, a third XOR value of the application category tag, a second OR value of the cloud gateway device identifier and the application category tag, and a third hash value; parsing the value-added service encapsulated message to obtain the service message includes: The third XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the application category label; A fourth hash value is calculated based on the application category tag, the fourth XOR value of the application category tag and the locally configured cloud gateway device identifier, and the third OR value of the application category tag and the locally configured cloud gateway device identifier. Based on the comparison result between the third hash value and the fourth hash value, the application category label validity verification result is determined; If the application category label validity verification result is successful, the value-added service encapsulated message is parsed to obtain the service message.

[0067] Specifically, the cloud gateway device can parse the third XOR value in the DOH field of the IPv6 header of the value-added service encapsulation message based on the locally configured cloud gateway device ID to obtain the parsed application category tag. Based on the parsed application category tag, the cloud gateway device can determine the fourth XOR value between the parsed application category tag and the locally configured cloud gateway device ID, as well as the third OR value between the parsed application category tag and the locally configured cloud gateway device ID. Next, a hash operation can be performed based on the parsed application category tag, the fourth XOR value, and the third OR value to obtain a fourth hash value, which is then compared with the third hash value in the DOH field of the IPv6 header of the value-added service encapsulation message.

[0068] If the third hash value matches the fourth hash value, it indicates that the application category label (i.e., the original label) filled in the IPv6 header DOH field of the value-added service encapsulated message has not been tampered with, and the message is legitimate. VxLAN resolution of the value-added service encapsulated message can be performed. If the third hash value does not match the fourth hash value, it indicates that the application category label (i.e., the original label) filled in the IPv6 header DOH field of the value-added service encapsulated message has been tampered with, and the message is illegitimate. Packet loss should be performed.

[0069] This invention enables tag encryption through the first XOR value of the cloud gateway device ID and the application category tag, and the first OR value of the cloud gateway device ID and the application category tag, thereby achieving secure identification and trusted access for the application category tag. By filling the encrypted application category tag into the DOH field of the IPv6 packet header, the cloud gateway device verifies the tag information based on the encrypted tag information, which can prevent the application category tag from being maliciously tampered with, causing low-priority services to use high-priority service tags and affecting service scheduling on the cloud gateway side.

[0070] Based on any of the above embodiments, the IPv6 header option extension field of the value-added service encapsulated message is encapsulated with a trusted label, the trusted label including a cloud gateway device identifier, a VxLAN tunnel identifier, a key value, the cloud gateway device identifier, and the fifth XOR value and fifth hash value of the VxLAN network; parsing the value-added service encapsulated message to obtain the service message includes: The fifth XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the VxLAN tunnel identifier; A hash operation is performed based on the VxLAN tunnel identifier, the locally configured cloud gateway device identifier, the key value, and the sixth XOR value of the VxLAN tunnel identifier and the locally configured cloud gateway device identifier to obtain the sixth hash value; Based on the comparison result between the fifth hash value and the sixth hash value, the validity verification result of the local gateway device is determined; If the validity verification result of the local gateway device is successful, the value-added service encapsulated message is parsed to obtain the service message.

[0071] Specifically, the cloud gateway device can parse the fifth XOR value in the DOH field of the IPv6 header of the value-added service encapsulation message based on the locally configured cloud gateway device ID to obtain the parsed VNI. Based on the parsed VNI, the cloud gateway device can determine the sixth XOR value between the parsed VNI and the locally configured cloud gateway device ID. Next, a hash operation can be performed on the parsed VNI, the locally configured cloud gateway device ID, the key value, and the sixth XOR value to obtain the sixth hash value, which is then compared with the fifth hash value in the DOH field of the IPv6 header of the value-added service encapsulation message.

[0072] If the fifth hash value matches the sixth hash value, it indicates that the user accessing the cloud gateway device is a trusted local broadband user, and the received packet is a legitimate packet. The user can then perform VxLAN parsing on the value-added service encapsulated packet. If the fifth hash value does not match the sixth hash value, it indicates that the user accessing the cloud gateway device is an untrusted local broadband user, and a malicious user is forging VxLAN packets to launch a malicious attack on the cloud gateway node. The received packet is an illegal packet, and the cloud gateway device can then process the received illegal packet by dropping it.

[0073] This invention encapsulates a trusted label in the DOH field of the IPv6 packet header and sends the packet with the trusted label to the cloud gateway. The cloud gateway device then authenticates the local gateway device based on the trusted label information. This enables trusted access for local broadband users in the cloud gateway scenario, thereby achieving trusted access to value-added services and preventing local broadband users outside the cloud gateway from accessing the cloud gateway device through a VxLAN tunnel.

[0074] Currently, home gateways transmit traffic to the cloud via VxLAN logical tunnels. However, the cloud side cannot determine whether the user transmitting the traffic is a home broadband user with a activated home broadband service, a cloud gateway user, or whether the traffic identification classification is abnormal (i.e., whether the application category label is abnormal). This invention addresses this by encapsulating an encrypted VxLAN tunnel identifier label and an encrypted application category label in the IPv6 header DOH field. This enables trusted cloud transmission of value-added services and trusted access for cloud gateway package users.

[0075] Figure 3 This is a schematic diagram of the cloud gateway access method provided in an embodiment of the present invention. (Refer to...) Figure 3In one embodiment, the RMS platform can distribute VxLAN tunnel identifier (VNI) information and key value (KEY) to the cloud gateway controller; the cloud gateway controller can distribute application category label mapping table, rule base, cloud gateway ID, VNI, and key (KEY) to the home gateway device; the cloud gateway controller can distribute application category label mapping table and key (KEY) to the cloud gateway node; the home gateway can distinguish between value-added service types and basic internet access types based on the application category label identified by the DPI module. Packets of value-added service types can be forwarded to the cloud gateway node of the edge cloud through IPv6 VxLAN encapsulation, wherein a trusted label and application category label are added to the IPv6 header of the packet; the cloud gateway node parses the trusted label in the IPv6 header and determines whether the home gateway belongs to a home broadband user who can access the cloud gateway package based on the trusted label information; if it belongs to a home broadband user who can access the cloud gateway package, the received packets are forwarded to dedicated bandwidth such as gaming services, education services, and cloud PC services based on the application label mapping table; the home gateway uses a session table to associate application category labels. If the label in the session table marks the basic internet access type, the packet traffic is processed for basic internet access through PPPoE encapsulation.

[0076] Figure 4 This is a schematic diagram of the cloud gateway access system provided in an embodiment of the present invention. (Refer to...) Figure 4 This invention provides a cloud gateway access system, comprising: The local gateway device 410 is used to determine the application category label of the service message; if the application category label of the service message is a value-added service type label, the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message; and the value-added service encapsulated message is forwarded to the cloud gateway device. The cloud gateway device 420 is used to parse the value-added service encapsulated message to obtain the service message; based on the association between the application category tag and the service application, the service message is forwarded to the service application corresponding to the application category tag.

[0077] This invention, through the local gateway device, determines the application category label of the service packet. If the application category label of the service packet is a value-added service type label, the service packet is encapsulated based on the application category label to obtain a value-added service encapsulated packet, which is then forwarded to the cloud gateway device. This allows value-added service packet traffic to be uploaded to the cloud based on the distinction between value-added service type and basic internet access type. The cloud gateway can directly forward the received value-added service packet traffic to the corresponding service application for processing based on the specific application category label determined by the local gateway device, achieving timely forwarding of packets on the cloud gateway side and improving the efficiency of value-added service processing.

[0078] Figure 5An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a cloud gateway access method, which includes: determining an application category label for a service message; if the application category label of the service message is a value-added service type label, then encapsulating the service message based on the application category label to obtain a value-added service encapsulated message; and forwarding the value-added service encapsulated message to the cloud gateway device; the application category label encapsulated in the value-added service encapsulated message is used to determine the corresponding service application.

[0079] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0080] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the cloud gateway access method provided by the above methods. The method includes: determining an application category label for a service message; if the application category label of the service message is a value-added service type label, then encapsulating the service message based on the application category label to obtain a value-added service encapsulated message; forwarding the value-added service encapsulated message to a cloud gateway device; the application category label encapsulated in the value-added service encapsulated message is used to determine the corresponding service application.

[0081] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the cloud gateway access method provided by the above methods. The method includes: determining an application category label for a service message; if the application category label of the service message is a value-added service type label, encapsulating the service message based on the application category label to obtain a value-added service encapsulated message; forwarding the value-added service encapsulated message to a cloud gateway device; wherein the application category label encapsulated in the value-added service encapsulated message is used to determine the corresponding service application.

[0082] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0083] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cloud gateway access method, characterized in that, Applied to local gateway devices, including: Determine the application category label for the business message; If the application category label of the service message is a value-added service type label, then the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message. The value-added service encapsulated message is forwarded to the cloud gateway device; the application category tag encapsulated in the value-added service encapsulated message is used to identify the corresponding service application.

2. The method according to claim 1, characterized in that, The process of encapsulating the service message based on the application category tag to obtain a value-added service encapsulated message includes: Based on the application category label, the service message is encapsulated using IPv6 VxLAN to obtain a value-added service encapsulated message. The value-added service encapsulation message is further divided into an inner layer encapsulating the service message, an outer layer encapsulating an IPv6 VxLAN message, and an outermost layer encapsulating a PPPoE (Point-to-Point Protocol over Ethernet) header. The IPv6 header option extension field of the IPv6 VxLAN message encapsulates the application category label, the cloud gateway device identifier, a first XOR value of the application category label, a first OR value of the cloud gateway device identifier and the application category label, and a first hash value. The first hash value is obtained by performing a hash operation based on the first XOR value, the first OR value, and the application category label.

3. The method according to claim 2, characterized in that, The IPv6 header option extension field of the value-added service encapsulation message contains a trusted label, which includes a cloud gateway device identifier, a VxLAN tunnel identifier, a key value, the cloud gateway device identifier, and a second XOR value and a second hash value of the VxLAN network. The second hash value is obtained by performing a hash operation based on the second XOR value, the cloud gateway device identifier, the VxLAN tunnel identifier, and the key value.

4. The method according to claim 1, characterized in that, The determination of the application category label for the service message includes: Identify untagged service messages; If the domain name and destination IP in the service message match the configuration rules issued by the controller, then based on the application category tag mapping table, the five-tuple session table corresponding to the service message is tagged with an application category tag to obtain a tag-tagged session flow table. When forwarding packets, the application category label of the service packet is determined based on the session flow table marked by the label.

5. A cloud gateway access method, characterized in that, Applied to cloud gateway devices, including: Receive a value-added service encapsulation message sent by a local gateway device; the value-added service encapsulation message is obtained by encapsulating the service message based on the application category tag when the application category tag of the service message is a value-added service type tag; The value-added service encapsulated message is parsed to obtain the service message; Based on the association between application category tags and business applications, the business message is forwarded to the business application corresponding to the application category tag.

6. The method according to claim 5, characterized in that, The IPv6 header option extension field of the value-added service encapsulation message encapsulates an application category label, a cloud gateway device identifier, a third XOR value of the application category label, a second OR value of the cloud gateway device identifier and the application category label, and a third hash value. The step of parsing the value-added service encapsulated message to obtain the service message includes: The third XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the application category label; The fourth hash value is calculated based on the application category tag, the fourth XOR value of the application category tag and the locally configured cloud gateway device identifier, and the third OR value of the application category tag and the locally configured cloud gateway device identifier. Based on the comparison result between the third hash value and the fourth hash value, the application category label validity verification result is determined; If the application category label validity verification result is successful, the value-added service encapsulated message is parsed to obtain the service message.

7. The method according to claim 5, characterized in that, The IPv6 header option extension field of the value-added service encapsulation message is encapsulated with a trusted label, which includes a cloud gateway device identifier, a VxLAN tunnel identifier, a key value, the cloud gateway device identifier, and the fifth XOR value and fifth hash value of the VxLAN network. The step of parsing the value-added service encapsulated message to obtain the service message includes: The fifth XOR value is parsed based on the locally configured cloud gateway device identifier to obtain the VxLAN tunnel identifier; A hash operation is performed based on the VxLAN tunnel identifier, the locally configured cloud gateway device identifier, the key value, and the sixth XOR value of the VxLAN tunnel identifier and the locally configured cloud gateway device identifier to obtain the sixth hash value; Based on the comparison result between the fifth hash value and the sixth hash value, the validity verification result of the local gateway device is determined; If the validity verification result of the local gateway device is successful, the value-added service encapsulated message is parsed to obtain the service message.

8. A cloud gateway access system, characterized in that, include: Local gateway devices are used to determine the application category label of service messages; If the application category label of the service message is a value-added service type label, then the service message is encapsulated based on the application category label to obtain a value-added service encapsulated message. The value-added service encapsulated message is forwarded to the cloud gateway device; A cloud gateway device is used to parse the value-added service encapsulated message to obtain the service message; Based on the association between application category tags and business applications, the business message is forwarded to the business application corresponding to the application category tag.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the cloud gateway access method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the cloud gateway access method as described in any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the cloud gateway access method as described in any one of claims 1 to 7.

Images