Access control method and device, network equipment, storage medium and program product

Abstract

The invention discloses an access control method and device, network equipment, a storage medium and a program product, relates to the technical field of computers, and can reduce the cost of deploying an access control strategy for accessing a server by a terminal. The access control method comprises the following steps: receiving an access message sent by target source equipment, wherein the access message comprises a source address, a source port, a destination address and a destination port; querying port identifiers corresponding to the source port and the destination port in an identifier mapping table based on the source address, the source port, the destination address and the destination port; the identifier mapping table comprises a corresponding relationship among a source address, a source port and a port identifier, and a corresponding relationship among a destination address, a destination port and the port identifier; querying a forwarding rule in an access permission matching table based on the port identifiers corresponding to the source port and the destination port; the access permission matching table comprises a corresponding relationship between port identifiers corresponding to the source port and the destination port and forwarding rules; and executing a specified action of the forwarding rule on the access message.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an access control method, apparatus, network device, storage medium, and program product. Background Technology

[0002] When a network forwarding device processes a packet to be forwarded (i.e., an access packet from a terminal to the server), it extracts relevant field information (i.e., source address, destination address, destination port number, etc.) from the packet to be forwarded, and then matches this relevant field information with a preset access control list (ACL) to determine whether the terminal is allowed to access the server, and thus whether to forward the packet to the server.

[0003] In network forwarding devices, embedded ternary content-addressable memory (TCAM) can be used to match packet information with access policies in the Access Control List (ACL). This requires deploying all access control policies in the ACL to the TCAM so that packet information can be matched against each policy one by one. However, the number of access control policies in the ACL is enormous, while the TCAM capacity is relatively small and cannot support the deployment of such a large number of policies. Alternatively, a large-capacity TCAM is needed, but large-capacity TCAMs are more expensive and consume more power. Therefore, the current cost of deploying access control policies for terminal access to the server is high. Summary of the Invention

[0004] This application provides an access control method, apparatus, network device, storage medium, and program product, which can reduce the cost of deploying access control policies for terminal access servers and improve the efficiency of determining the forwarding rules corresponding to access packets.

[0005] Firstly, an access control method is provided. The method includes: receiving an access message sent by a target source device, wherein the access message includes a source address, a source port, a destination address, and a destination port. Then, based on the source address, source port, destination address, and destination port, the method queries an identifier mapping table to find the port identifiers corresponding to the source port and destination port; wherein the identifier mapping table includes the correspondence between the source address, source port, and port identifier, and the correspondence between the destination address, destination port, and port identifier. Furthermore, based on the port identifiers corresponding to the source port and destination port, the method queries an access permission matching table to query a forwarding rule, so as to execute the prescribed action of the forwarding rule on the access message. The access permission matching table includes the correspondence between the port identifiers corresponding to the source port and destination port and the forwarding rule.

[0006] According to the above method, when an access packet containing source address, source port, destination address, and destination port is received from the target source device, the identifier mapping table includes the correspondence between source address, source port, and port identifier, as well as the correspondence between destination address, destination port, and port identifier. Therefore, the port identifier corresponding to the source port and the port identifier corresponding to the destination port can be queried from the identifier mapping table. Furthermore, since the access permission matching table includes the correspondence between the port identifier corresponding to the source port and the port identifier corresponding to the destination port and the forwarding rules, the forwarding rules corresponding to the two port identifiers (i.e., the port identifier corresponding to the source port and the port identifier corresponding to the destination port) can be queried from the access permission matching table. Thus, the prescribed action of the forwarding rules is executed on the received access packet sent by the target source device. In this way, when an access packet is received, this application can determine the forwarding rule corresponding to the access packet based on the identifier mapping table and the access permission matching table, without having to match the access packet with the ACL deployed in the TCAM to determine the corresponding forwarding rule. Since the identifier mapping table and the access permission matching table do not need to be deployed in the TCAM, the deployment of the identifier mapping table and the access permission matching table can be satisfied without a large-capacity TCAM. This can reduce the cost of deploying access control policies for terminal access servers and improve the efficiency of determining the forwarding rules corresponding to access packets.

[0007] In one possible design, the identifier mapping table includes a correspondence between multiple ports and port identifiers, and a correspondence between multiple addresses and address identifiers, with a correspondence between multiple ports and multiple addresses, and each address corresponding to at least one port.

[0008] In other words, based on the correspondence between ports and port identifiers, and between addresses and address identifiers included in the identifier mapping table, and combined with the correspondence between ports and addresses, the source address, source port, destination address, and destination port identifiers of the access packet can be determined. Therefore, the identifier mapping table allows for rapid determination of the identifiers corresponding to ports and addresses, improving the efficiency of identifier determination.

[0009] In another possible design, the identifier mapping table includes a first mapping table and a second mapping table; the first mapping table includes the correspondence between addresses and address identifiers; the second mapping table includes the correspondence between address identifiers, ports, and port identifiers.

[0010] In another possible design approach, based on the source address, source port, destination address, and destination port, the port identifiers corresponding to the source port and destination port are queried in the identifier mapping table. This includes: firstly, based on the source address and destination address, the address identifiers corresponding to the source address and destination address are queried in the first mapping table; then, based on the source port and the address identifiers corresponding to the source address, the port identifiers corresponding to the source port are queried in the second mapping table; and finally, based on the destination port and the address identifiers corresponding to the destination address, the port identifiers corresponding to the destination port are queried in the second mapping table.

[0011] Thus, by storing the correspondence between addresses and address identifiers, and the correspondence between address identifiers, ports, and port identifiers, in a two-level mapping table, the address identifier can be determined first through the first-level mapping table, and then the port identifier corresponding to that address identifier can be determined based on the determined address identifier and the second-level mapping table. This improves the accuracy and efficiency of determining address and port identifiers.

[0012] In another possible design approach, the access permission matching table includes a mapping between identifier groups and forwarding rules, where each identifier group includes a port identifier corresponding to the source port and a port identifier corresponding to the destination port.

[0013] In another possible design approach, forwarding rules are queried from the access permission matching table based on the port identifiers corresponding to the source and destination ports. This includes: first, determining the target identifier group, which includes the port identifiers corresponding to the source and destination ports, from the access permission matching table; and then, determining the forwarding rule corresponding to the target identifier group from the access permission matching table.

[0014] In other words, based on the correspondence between identifier groups and forwarding rules included in the access permission matching table, after determining the port identifiers corresponding to the source port and the destination port, the forwarding rules corresponding to these two port identifiers can be determined from the access permission matching table. Therefore, based on the determined forwarding rules, the corresponding actions can be executed on the access packets. This allows for rapid determination of the corresponding forwarding rules using the access permission matching table, improving the efficiency of forwarding rule determination.

[0015] In another possible design approach, before receiving access packets sent by the target source device, the method further includes: first, generating an identifier mapping table and an access permission matching table based on the acquired access control policy, wherein the access control policy is a port-level access control policy. Then, deploying the identifier mapping table and the access permission matching table.

[0016] In another possible design approach, an identifier mapping table is generated based on the obtained access control policy. This includes: first, assigning address identifiers to at least one address corresponding to each of the multiple devices based on the obtained access control policy, generating a first mapping table; then, assigning port identifiers to at least one port corresponding to each address based on the first mapping table, generating a second mapping table.

[0017] In another possible design approach, an access permission matching table is generated based on the obtained access control policy, including: determining the correspondence between multiple identifier groups and forwarding rules based on the obtained access control policy, the first mapping table, and the second mapping table, and generating the access permission matching table.

[0018] In other words, this application, based on access control policies, can assign address identifiers to the addresses corresponding to each device and port identifiers to the ports corresponding to each address, thereby obtaining a corresponding identifier mapping table. Then, based on the identifier mapping table and access control policies, the correspondence between multiple identifier groups and forwarding rules can be determined, resulting in an access permission matching table, which can then be deployed. Since the identifier mapping table and access permission matching table do not need to be deployed in the TCAM, a large-capacity TCAM is not required to meet the deployment needs of the identifier mapping table and access permission matching table. This reduces the cost of deploying access control policies for terminal access to the server.

[0019] In another possible design approach, where the port number is a consecutive range of port numbers, multiple port numbers within that consecutive range correspond to the same port identifier.

[0020] In this way, for a continuous range of port numbers, there is no need to split the continuous range of port numbers into individual port numbers; instead, a port identifier is assigned to each port number. This reduces the workload of assigning port identifiers and improves the efficiency of determining port identifiers later.

[0021] In another possible design, each forwarding rule in the access permission matching table includes: a first protocol type and a first data transmission direction; the access message also includes: a second protocol type and a second data transmission direction. Based on this, the actions specified by the forwarding rules are executed on the access message, including: firstly determining whether the first protocol type and the second protocol type match, and whether the first data transmission direction and the second data transmission direction match. Thus, if both the protocol type and the data transmission direction match, the actions specified by the forwarding rules are executed on the access message.

[0022] Therefore, after determining the forwarding rules corresponding to the access message, we can further determine the protocol type and data transmission direction of the access message to ascertain whether the access message matches the forwarding rules. Only when both the protocol type and data transmission direction match will the prescribed action of the forwarding rules be executed on the access message. This further improves the accuracy of determining the forwarding rules corresponding to the access message based on the protocol type and data transmission direction.

[0023] Secondly, an access control device is provided, which includes a receiving module and a processing module.

[0024] The aforementioned receiving module is used to receive access messages sent by the target source device. The access message includes: source address, source port, destination address, and destination port.

[0025] The aforementioned processing module is used to query the port identifiers corresponding to the source port and destination port in the identifier mapping table based on the source address, source port, destination address, and destination port. The identifier mapping table includes the correspondence between the source address, source port, and port identifier, as well as the correspondence between the destination address, destination port, and port identifier.

[0026] The aforementioned processing module is also used to query forwarding rules in the access permission matching table based on the port identifiers corresponding to the source port and the destination port; the access permission matching table includes the correspondence between the port identifiers corresponding to the source port and the destination port and the forwarding rules.

[0027] The aforementioned processing module is also used to perform the prescribed actions of the forwarding rules on the access packets.

[0028] In one possible design approach, the identifier mapping table includes a correspondence between multiple ports and port identifiers, and a correspondence between multiple addresses and address identifiers, with a correspondence between multiple ports and multiple addresses, and each address corresponding to at least one port.

[0029] In another possible design, the identifier mapping table includes a first mapping table and a second mapping table; the first mapping table includes the correspondence between addresses and address identifiers; the second mapping table includes the correspondence between address identifiers, ports, and port identifiers.

[0030] In another possible design, the above processing module is specifically used to query the address identifier corresponding to the source address and the address identifier corresponding to the destination address in the first mapping table based on the source address and the destination address.

[0031] The aforementioned processing module is specifically used to query the port identifier corresponding to the source port in the second mapping table based on the address identifier corresponding to the source port and the source address.

[0032] The aforementioned processing module is specifically used to query the port identifier corresponding to the destination port in the second mapping table based on the address identifier corresponding to the destination port and the destination address.

[0033] In another possible design approach, the access permission matching table includes a mapping between identifier groups and forwarding rules, where each identifier group includes a port identifier corresponding to the source port and a port identifier corresponding to the destination port.

[0034] In another possible design, the aforementioned processing module is specifically used to determine a target identifier group that includes the port identifiers corresponding to the source port and the destination port from an access permission matching table based on the port identifiers corresponding to the source port and the destination port.

[0035] The aforementioned processing module is specifically used to determine the forwarding rules corresponding to the target identifier group from the access permission matching table.

[0036] In another possible design, the aforementioned processing module is also used to generate an identifier mapping table and an access permission matching table based on the obtained access control policy, wherein the access control policy is a port-level access control policy.

[0037] The aforementioned processing module is also used to deploy the identifier mapping table and the access permission matching table.

[0038] In another possible design, the aforementioned processing module is specifically used to assign an address identifier to at least one address corresponding to each of the multiple devices based on the obtained access control policy, and generate a first mapping table.

[0039] The aforementioned processing module is specifically used to assign a port identifier to at least one port corresponding to each address based on the first mapping table, and generate a second mapping table.

[0040] In another possible design, the aforementioned processing module is specifically used to determine the correspondence between multiple identifier groups and forwarding rules based on the obtained access control policy, the first mapping table, and the second mapping table, and to generate an access permission matching table.

[0041] In another possible design approach, where the port number is a consecutive range of port numbers, multiple port numbers within that consecutive range correspond to the same port identifier.

[0042] In another possible design, each forwarding rule in the access permission matching table includes: a first protocol type and a first data transmission direction, and the access message also includes: a second protocol type and a second data transmission direction.

[0043] The aforementioned processing module is specifically used to determine whether the first protocol type and the second protocol type match, and whether the first data transmission direction and the second data transmission direction match.

[0044] The aforementioned processing module is specifically used to execute the prescribed actions of the forwarding rules on the access message when both the protocol type and data transmission direction match.

[0045] Thirdly, a network device is provided, the network device including a memory and a processor, the memory being coupled to the processor; the memory is used to store computer program code, the computer program code including computer instructions; when the computer instructions are executed by the processor, the network device causes to perform the method as described in the first aspect.

[0046] Fourthly, a network device cluster is provided, comprising at least one network device, each network device including a processor and a memory; the processor of the at least one network device is configured to execute instructions stored in the memory of the at least one network device, such that the network device cluster performs the method as described in the first aspect.

[0047] Fifthly, a computer-readable storage medium is provided, the computer-readable storage medium including computer program instructions that, when executed by a network device, cause the network device to perform the method described in the first aspect.

[0048] In a sixth aspect, a computer program product containing instructions is provided, which, when executed by a network device, cause the network device to perform the method described in the first aspect.

[0049] It is understood that the beneficial effects achieved by the access control device described in the second aspect, the network device described in the third aspect, the network device cluster described in the fourth aspect, the computer storage medium described in the fifth aspect, and the computer program product described in the sixth aspect can be referred to as the beneficial effects in the first aspect and any possible design, which will not be repeated here. Attached Figure Description

[0050] Figure 1 A schematic diagram illustrating a user accessing an application service provided in this application;

[0051] Figure 2 A schematic diagram illustrating the composition of an access control system architecture provided in this application;

[0052] Figure 3 A flowchart illustrating an access control method provided in this application;

[0053] Figure 4 A flowchart illustrating another access control method provided in this application;

[0054] Figure 5 A schematic diagram of the composition of an access control device provided in this application;

[0055] Figure 6 A schematic diagram illustrating the composition of an access control system provided in this application;

[0056] Figure 7 A schematic diagram of the structural composition of a network device provided in this application;

[0057] Figure 8 A schematic diagram of a network device cluster provided in this application;

[0058] Figure 9 This is a schematic diagram illustrating a connection method between network device clusters provided in this application. Detailed Implementation

[0059] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0060] In this application, the character " / " generally indicates that the objects before and after it are in an "or" relationship. For example, A / B can be understood as A or B.

[0061] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "a plurality of" means two or more.

[0062] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the steps or modules listed, but may optionally include other steps or modules not listed, or may optionally include other steps or modules inherent to such process, method, product, or device.

[0063] Furthermore, in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design that is described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design options. Specifically, the use of the words "exemplary" or "for example" is intended to present concepts in a concrete manner.

[0064] Currently, for clients in corporate parks, the requirements for cybersecurity and regulatory compliance are becoming increasingly stringent. These requirements are typically based on the zero-trust principle and the principle of least privilege (i.e., defining the permissions a user has to access each application service), demanding that access control policies be relaxed at the protocol port level. This is especially true for clients in the financial industry, who, in accordance with regulatory requirements, typically refine access rules down to the port level when developing access policies for their employees (i.e., defining access rules for user access ports). This means granting users access permissions based on the specified port for the user, application, or specific service address.

[0065] For example, based on factors such as user experience and application service architecture, different protocol types and ports can be used for different scenarios. Typically, a single application contains multiple ports (port values ​​range from 0 to 65535). That is, an application service's IP address is usually assigned several corresponding ports or port ranges (generally, the number of ports or port ranges will not exceed 8). Since users usually do not specify the port when accessing application services, the main focus when formulating access control policies is to determine the access rules for users accessing the application service via that port.

[0066] like Figure 1 As shown, Figure 1 This diagram illustrates how users access application services, using 3 users and 4 application services as an example. Each of the 4 application services has multiple addresses and multiple ports. Application service 1 corresponds to addresses 10.180.18.7 and 10.180.18.10, and ports 80 and 443 (TCP). Application service 2 corresponds to addresses 10.173.11.100 and 10.173.11.111, and ports 8000, 10104, 30000, and 31480 (TCP). Application service 3 corresponds to addresses 172.18.14.9 and 172.18.14.29, and ports 20, 21, and 80 (TCP). Application service 4 corresponds to addresses 10.170.3.27, 10.170.3.32, and 10.170.3.41, and ports 443, 3306, 3307, and 8080 (TCP), and ports 8080 (User Datagram Protocol). Ports 3306 and 3307 (UDP protocol) are of type UDP.

[0067] Specifically, Figure 1Each user can access at least one of the four application services. For example, user 1 can access application service 1 and application service 2, user 2 can access application service 1 and application service 3, and user 3 can access application service 1 and application service 4. Based on this, the access control policy for user 1 can be formulated as follows:

[0068] rule 1permit tcp source user1 destination 10.180.18.7destination-port80;

[0069] rule 2permit tcp source user1 destination 10.180.18.7destination-port443;

[0070] rule 3permit tcp source user1 destination 10.180.18.10destination-port 80;

[0071] rule 4permit tcp source user1 destination 10.180.18.10destination-port 443.

[0072] It should be noted that the above access control policy is based on the TCAM ACL rule scheme. An ACL is a collection of ordered (i.e., priority) rule groups, described according to the source address, destination address, port number, etc. of the data packet. In network forwarding devices, for an access packet to be forwarded, relevant field information such as the aforementioned source address, destination address, and destination port can be extracted. This information is then matched against preset ACL rules. If a match is successful, the action defined by the rule is applied; if a match fails, the default rule action (usually deny) is applied. If the relevant field information of the access packet matches multiple access rules simultaneously, the matching is performed according to priority (which can be the rule number, with earlier numbers indicating higher priority).

[0073] Current network forwarding devices typically use embedded TCAMs to match ACL rule sets. TCAMs have the ability to match input rules once and simultaneously determine if all access rules match. Therefore, they are particularly suitable for ACL rule matching scenarios. All ACL rules are written to the TCAM device at once. For each packet to be forwarded (i.e., an access packet), all ACL rules are matched at once, and then the packet is processed according to the action defined by the highest priority rule in the matching results.

[0074] However, a common problem with using embedded TCAM to match ACL rule sets is that:

[0075] 1) TCAMs are costly, power-hungry, and have limited capacity, making them unsuitable for deploying massive numbers of rules. For example, suppose a customer campus has 1,000 users (groups) and 100 application services, each with one IP address (in reality, some application services may have multiple IP addresses), and each address can bind a maximum of 8 ports (or port groups). Assuming the 1,000 users (groups) can access the 100 application services, the total number of rules required for this campus would be 1,000 * 100 * 8, or 800,000 access rules. Typical TCAMs can only deploy a few thousand to 128,000 rules, which is insufficient for such a large-scale deployment. Furthermore, if we consider the scenario where each application service has multiple IP addresses, such as a server cluster or multi-IP load balancing, the total number of access rules required would be even greater, making it difficult to meet the deployment needs of massive numbers of rules using typical TCAM devices.

[0076] 2) ACL rules are discrete. For non-contiguous ports or port ranges, each port requires a corresponding access rule, which leads to a significant increase in the number of rules and further increases the deployment space required for the rules. For example, for ports 3-6, if the TCAM mask method is used to match this port range, the access rules corresponding to ports 3-6 need to be split into three cases: 3, 4-5, and 6. Specifically, the mask for port 3 is: Rule1port = 3 (011), mask 111; the mask for ports 4-5 is: Rule2 port = 4-5 (100, 101), mask 110; and the mask for port 6 is: Rule3 port = 6 (110), mask 111. The mask for ports 4-5 uses 110, meaning the last bit of the 3-bit binary number in the mask is irrelevant.

[0077] Furthermore, access control policies can currently be deployed using an ACL scheme based on an adaptive compress bit choice (ACBC) algorithm using a flow classification engine (CE). Essentially, this scheme uses a bit tree to classify the massive ACL list, placing similar rule subsets into a smaller rule cache, effectively distributing the entire rule set. When a network forwarding device processes an access packet to be forwarded, after several classification and matching operations, the packet is matched to a rule cache. The device then only needs to match the rule subsets within that cache to determine the matching result for the access packet and execute the corresponding processing action.

[0078] However, this solution still has some drawbacks: Limited table entry specifications, while partially addressing the need for large-space TCAMs, do not reduce the storage space requirements for content addressable memory (CAM) devices. The final rule cache still needs to store the complete rule set, albeit without requiring contiguous CAM storage space. Furthermore, it still cannot resolve the issue of discrete, non-contiguous ports or port ranges within the rule set, which can lead to a significant increase in the number of rules. Additionally, when adding, deleting, or modifying access rules, to ensure the balance of the rule subset cache (i.e., ensuring that the number of rules cached in all rule cache areas is less than a preset value), it is necessary to reconstruct the rule subset cached in the split rule cache area, resulting in longer processing times and lower performance.

[0079] Therefore, this application provides an access control method. When an access packet including a source address, source port, destination address, and destination port is received from a target source device, since the identifier mapping table includes the correspondence between the source address, source port, and port identifier, as well as the correspondence between the destination address, destination port, and port identifier, the port identifier corresponding to the source port and the port identifier corresponding to the destination port can be queried from the identifier mapping table. Furthermore, since the access permission matching table includes the correspondence between the port identifier corresponding to the source port and the port identifier corresponding to the destination port and the forwarding rules, the forwarding rules corresponding to the two port identifiers (i.e., the port identifier corresponding to the source port and the port identifier corresponding to the destination port) can be queried from the access permission matching table. Thus, the prescribed action of the forwarding rules is executed on the received access packet sent by the target source device. In this way, when an access packet is received, this application can determine the forwarding rule corresponding to the access packet based on the identifier mapping table and the access permission matching table, without having to match the access packet with the ACL deployed in TCAM to determine the corresponding forwarding rule. Since the identifier mapping table and access permission matching table do not need to be deployed in the TCAM, a large-capacity TCAM is not required to meet the deployment needs of the identifier mapping table and access permission matching table. This reduces the cost of deploying access control policies for terminal access to the server and improves the efficiency of determining the forwarding rules corresponding to access packets.

[0080] refer to Figure 2 The access control method provided in this application can be applied to an implementation environment (i.e., an access control system) consisting of multiple source devices, network devices, and multiple destination devices. Figure 2 As shown, the implementation environment may include source device 101, network device 102, and destination device 103. There can be multiple source devices 101 and multiple destination devices 103. Source device 101 can send access messages to destination device 103 through network device 102 to access destination device 103. Network device 102 is used to determine the validity of the access messages sent by source device 101 to destination device 103 and forward the access messages from source device 101 to destination device 103.

[0081] The implementation environment of this application embodiment is mainly the process of a terminal (i.e., the source device) accessing an application service (i.e., the destination device) through an access network. Access control policies for terminal access to network application services are deployed on the access network system / network element (i.e., network device). These access control policies contain a large number of matching rules for specific ports or port ranges under the address corresponding to the application service. If the port of the application service accessed by the terminal is permitted, access is granted; otherwise, access is terminated or other preset processing (redirection, copy analysis, etc.) is performed.

[0082] In one possible design, network device 102 receives access packets sent by a target source device. The access packet includes a source address, source port, destination address, and destination port. Based on the source address, source port, destination address, and destination port, it queries an identifier mapping table to find the corresponding port identifiers for the source and destination ports. The identifier mapping table includes the correspondence between the source address, source port, and port identifier, as well as the correspondence between the destination address, destination port, and port identifier. Based on the port identifiers corresponding to the source and destination ports, it queries an access permission matching table to find forwarding rules. The access permission matching table includes the correspondence between the port identifiers corresponding to the source and destination ports and the forwarding rules. This allows the network device 102 to execute the actions specified by the forwarding rules on the access packet.

[0083] In one possible design, network device 102 can look up the address identifier corresponding to the source address and the address identifier corresponding to the destination address in a first mapping table based on the source address and the destination address; and look up the port identifier corresponding to the source port in a second mapping table based on the source port and the address identifier corresponding to the source address; and look up the port identifier corresponding to the destination port in a second mapping table based on the destination port and the address identifier corresponding to the destination address.

[0084] In one possible design, network device 102 can determine a target identifier group, which includes the port identifiers corresponding to the source port and the destination port, from the access permission matching table based on the port identifiers corresponding to the source port and the destination port; and determine the forwarding rule corresponding to the target identifier group from the access permission matching table.

[0085] In one possible design, network device 102 can generate an identifier mapping table and an access permission matching table based on the obtained access control policy, wherein the access control policy is a port-level access control policy; and deploy the identifier mapping table and the access permission matching table.

[0086] In one possible design, network device 102 can, based on the acquired access control policy, assign address identifiers to at least one address corresponding to each of the multiple devices, generating a first mapping table; and, based on the first mapping table, assign port identifiers to at least one port corresponding to each address, generating a second mapping table. Furthermore, based on the acquired access control policy, the first mapping table, and the second mapping table, it determines the correspondence between multiple identifier groups and forwarding rules, generating an access permission matching table.

[0087] In one possible design, network device 102 can determine whether the first protocol type included in the forwarding rule matches the second protocol type included in the access message, and whether the first data transmission direction included in the forwarding rule matches the second data transmission direction included in the access message; so that if both the protocol type and data transmission direction match, the prescribed action of the forwarding rule is performed on the access message.

[0088] In one possible design, network device 102 may include a processor and a transmitter. The processor is configured to support network device 102 in performing the corresponding functions described in the system. The transmitter supports communication between source device 101 and destination device 103, sending access messages and other information related to the system to destination device 103. Network device 102 may also include a memory coupled to the processor, which stores necessary access control policies, program instructions, and data for network device 102. Network device 102 may also include a receiver for receiving access messages sent by source device 101, or information sent by other electronic devices.

[0089] For example, the network device 102 in this embodiment can be various types of switches (LAN switches, LSWs, access switches, aggregation switches, core switches), wireless access points (APs), various types of firewalls (FWs), access gateways, access servers (or server groups), routers, hubs, bridges, fiber optic transceivers, and other network forwarding devices. This network device 102 has the functions to implement the above-described system. These functions can be implemented through hardware or by executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions; these modules can be software and / or hardware.

[0090] Network devices provide a means for source devices to access application services on destination devices for use by client applications (systems). Network devices offer applications a simple and manageable mechanism for accessing system resources. They also provide services such as implementations of the Hypertext Transfer Protocol (HTTP) and database connection management.

[0091] In one possible design, network device 102 may include a port-level policy deployment system. This system contains multiple components (i.e., functional modules), such as a control module and a forwarding module. The control module, also known as the policy parsing module, receives user-defined port-level access control policies and maps the source address, source port, destination address, and destination port of the access control policy to generate an identifier mapping table. It also constructs an access permission matching table corresponding to the mapped source and destination ports. The identifier mapping table and access permission matching table are then sent to the forwarding module. The forwarding module parses access packets, extracts the source address, source port, destination address, and destination port from the packet, and uses the identifier mapping table to obtain the mapped port identifiers corresponding to the source and destination ports. It then searches the access permission matching table based on the port identifiers to match access rules and performs subsequent packet forwarding processing based on the matching results.

[0092] It should be noted that the port-level policy deployment system includes multiple modules (i.e., control module and forwarding module), which can be centrally deployed in a single network device or in a distributed architecture, with each module deployed on different network devices. For example, the control module can be deployed on management devices such as network management systems and controllers, while the forwarding module can be deployed on forwarding network elements such as LSWs, FWs, gateways, APs, and access servers.

[0093] For example, the source device in the embodiments of this application may be a tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, smart IoT terminal (large screen display, camera, light, door lock, etc.), home router, proxy server, etc. The embodiments of this application do not impose special restrictions on the specific form of the device.

[0094] For example, the target device in this application embodiment can be a cloud service, microservice, application server, server cluster, or other such device. The target device exposes a specific service address (IP) and a specific service port (such as any protocol port like 80, 8080, 23, etc.) to the outside world.

[0095] The execution entity of the access control method provided in this application can be the central processing unit (CPU) of a network device, or the control module in the network device used to control access messages, or the application system in the network device used to control access messages.

[0096] The technical solutions provided in this application can be applied to the above-described implementation environment. The implementation environment described in this application is for the purpose of more clearly illustrating the technical solutions of this application and does not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will understand, as the implementation environment evolves, the technical solutions provided in this application are also applicable to similar technical problems.

[0097] The methods in the following embodiments can all be implemented in network devices with the above-described implementation environment. The following embodiments use a network device as an example to illustrate the methods of the embodiments of this application, specifically the access control method provided in this application.

[0098] This application provides an access control method applied to network devices, such as... Figure 3 As shown, the access control method may include S301-S304.

[0099] S301. The network device receives the access message sent by the target source device.

[0100] The access message includes: source address, source port, destination address, and destination port.

[0101] In this embodiment of the application, when the target source device accesses the destination device and sends an access message to the destination device, it needs to send the access message to the network device first so that the network device can determine the legality of the access message. If the access message is legal, the network device will forward the access message to the destination device.

[0102] Therefore, when a network device receives an access message sent by a target source device, it needs to verify the access message through a local port-level policy deployment system to determine the legitimacy of the access message.

[0103] S302. The network device queries the identifier corresponding to the source port and destination port in the identifier mapping table based on the source address, source port, destination address and destination port.

[0104] The identifier mapping table includes the correspondence between source address, source port and port identifier, as well as the correspondence between destination address, destination port and port identifier.

[0105] Optionally, a port-level policy deployment system in the network device can parse access packets to determine the source address, source port, destination address, and destination port from the access packets.

[0106] It should be noted that the source address or destination address determined from the access message can be a specific address field, such as 10.180.18.7 or 10.180.18.10; the source port or destination port determined from the access message can be the port number, such as 80 or 443.

[0107] Optionally, the identifier mapping table can be a pre-determined mapping table stored locally on the network device.

[0108] One possible implementation is that the identifier mapping table includes a correspondence between multiple ports and port identifiers, and a correspondence between multiple addresses and address identifiers. There is a correspondence between multiple ports and multiple addresses, and each address corresponds to at least one port.

[0109] It can be understood that the identifier mapping table includes the correspondence between multiple ports and port identifiers, specifically the correspondence between port numbers and port identifiers; the identifier mapping table also includes the correspondence between multiple addresses and address identifiers, specifically the correspondence between address fields and address identifiers.

[0110] Thus, after parsing the source address, source port, destination address, and destination port from the access message, the address identifier corresponding to the source address, the port identifier corresponding to the source port, the address identifier corresponding to the destination address, and the port identifier corresponding to the destination port can be determined from the identifier mapping table.

[0111] Optionally, if any of the address identifier corresponding to the source address, the port identifier corresponding to the source port, the address identifier corresponding to the destination address, and the port identifier corresponding to the destination port cannot be determined from the identifier mapping table, then the target source device is considered not to have permission to access the destination device (i.e., the access packet is invalid), and the access packet can be discarded directly.

[0112] In other words, based on the correspondence between ports and port identifiers, and between addresses and address identifiers included in the identifier mapping table, and combined with the correspondence between ports and addresses, the source address, source port, destination address, and destination port identifiers of the access packet can be determined. Therefore, the identifier mapping table allows for rapid determination of the identifiers corresponding to ports and addresses, improving the efficiency of identifier determination.

[0113] One possible implementation is that the identifier mapping table includes a first mapping table and a second mapping table; the first mapping table includes the correspondence between addresses and address identifiers; the second mapping table includes the correspondence between address identifiers, ports, and port identifiers.

[0114] Optionally, the identifier mapping table can be a two-level mapping table, where the first mapping table included in the identifier mapping table is the first-level mapping table, and the second mapping table is the second-level mapping table. The second-level mapping table is derived from the first-level mapping table, meaning it includes the content of the first-level mapping table (i.e., address identifiers). Thus, the first-level mapping table stores the correspondence between addresses and address identifiers, while the second-level mapping table stores the correspondence between address identifiers, ports, and port identifiers.

[0115] The specific structures of the first and second mapping tables can be found in Tables 2 and 3 in the examples below, and will not be repeated here.

[0116] One possible implementation is based on a two-level mapping table. Based on the source address, source port, destination address, and destination port, the interface queries the identifiers corresponding to the source and destination ports in the identifier mapping table. Specifically, this includes:

[0117] First, based on the source address and the destination address, look up the address identifier corresponding to the source address and the address identifier corresponding to the destination address in the first mapping table.

[0118] Then, based on the address identifier corresponding to the source port and the source address, the port identifier corresponding to the source port is queried in the second mapping table; and based on the address identifier corresponding to the destination port and the destination address, the port identifier corresponding to the destination port is queried in the second mapping table.

[0119] Thus, based on the two-level mapping table, after determining the address identifier corresponding to the source address and the address identifier corresponding to the destination address from the first mapping table, since there is a correspondence between the source address and the source port, the port identifier corresponding to the source port can be determined from the second mapping table based on the address identifier corresponding to the source address. Similarly, since there is a correspondence between the destination address and the destination port, the port identifier corresponding to the destination port can be determined from the second mapping table based on the address identifier corresponding to the destination address.

[0120] For example, a network device can deploy a system using port-level policies to parse and extract the source IP (i.e., source address), source Port (i.e., source port), destination IP (i.e., destination address), and destination Port (i.e., destination port) from access packets. Then, it determines the uid (i.e., address identifier) ​​corresponding to the source IP and the aid (i.e., address identifier) ​​corresponding to the destination IP from a first mapping table. Based on the uid, it determines the upid (i.e., port identifier) ​​corresponding to the source Port from a second mapping table, and based on the aid, it determines the apid (i.e., port identifier) ​​corresponding to the destination Port from the second mapping table. Finally, based on the upid + apid, the corresponding forwarding rule can be determined from the access permission matching table.

[0121] In this embodiment, a two-level mapping table stores the correspondence between addresses and address identifiers, as well as the correspondence between address identifiers, ports, and port identifiers. When determining address identifiers and port identifiers, the address identifier is first determined using the first-level mapping table, and then, based on the determined address identifier and the second-level mapping table, the port identifier corresponding to that address identifier is determined. This improves the accuracy and efficiency of determining address identifiers and port identifiers.

[0122] S303. The network device queries the access permission matching table for forwarding rules based on the port identifiers corresponding to the source port and destination port.

[0123] The access permission matching table includes the correspondence between the port identifiers of the source port and the destination port and the forwarding rules.

[0124] Optionally, the access permission matching table can be a pre-determined matching table stored locally on the network device.

[0125] The specific structure of the access permission matching table can be found in Tables 4 and 5 in the examples below, and will not be repeated here.

[0126] One possible implementation is that the access permission matching table includes the correspondence between identifier groups and forwarding rules, with each identifier group including the port identifier corresponding to the source port and the port identifier corresponding to the destination port.

[0127] It should be noted that at least one of the port identifiers corresponding to the source port and the destination port in any two identifier groups must be different. That is, for two identifier groups, the port identifier corresponding to the source port in the first identifier group is different from the port identifier corresponding to the source port in the second identifier group, and / or, the port identifier corresponding to the destination port in the first identifier group is different from the port identifier corresponding to the destination port in the second identifier group.

[0128] It is understandable that the access permission matching table includes multiple mappings, each mapping indicating an identifier group and a forwarding rule. That is, each mapping can determine the forwarding rule for accessing a destination port through a source port.

[0129] One possible implementation involves querying a forwarding rule in an access permission matching table based on the port identifiers corresponding to the source and destination ports. This includes: determining a target identifier group from the access permission matching table that includes the port identifiers corresponding to the source and destination ports; and determining the forwarding rule corresponding to the target identifier group from the access permission matching table.

[0130] It is understandable that since each identifier group in the access permission matching table includes two port identifiers, it is possible to find an identifier group that includes the port identifier corresponding to the source port and the port identifier corresponding to the destination port from the access permission matching table, thereby determining the forwarding rule that corresponds to this identifier group.

[0131] Optionally, if the target identifier group, which includes the port identifier corresponding to the source port and the port identifier corresponding to the destination port, is not found in the access permission matching table, the ACL can be used to re-determine whether the target source device is allowed to access the destination device; or the access packet can be discarded.

[0132] In other words, based on the correspondence between identifier groups and forwarding rules included in the access permission matching table, after determining the port identifiers corresponding to the source port and the destination port, the forwarding rules corresponding to these two port identifiers can be determined from the access permission matching table. Therefore, based on the determined forwarding rules, the corresponding actions can be executed on the access packets. This allows for rapid determination of the corresponding forwarding rules using the access permission matching table, improving the efficiency of forwarding rule determination.

[0133] S304. Network devices perform the prescribed actions according to the forwarding rules for access packets.

[0134] Optionally, after querying the access permission matching table to find the target identifier group including the port identifier corresponding to the source port and the port identifier corresponding to the destination port, and determining the corresponding forwarding rule, the access packet can be processed according to the action indicated by the corresponding forwarding rule (e.g., permit indicates that access is allowed) (that is, the access packet is forwarded to the destination device).

[0135] For example, a network device may forward an access packet to the destination device based on a defined forwarding rule; or it may discard the access packet.

[0136] In this embodiment, when an access packet containing a source address, source port, destination address, and destination port is received from a target source device, the identifier mapping table contains the correspondence between the source address, source port, and port identifier, as well as the correspondence between the destination address, destination port, and port identifier. Therefore, the port identifier corresponding to the source port and the port identifier corresponding to the destination port can be queried from the identifier mapping table. Furthermore, since the access permission matching table contains the correspondence between the port identifier corresponding to the source port and the port identifier corresponding to the destination port and the forwarding rules, the forwarding rules corresponding to the two port identifiers (i.e., the port identifier corresponding to the source port and the port identifier corresponding to the destination port) can be queried from the access permission matching table. Thus, the prescribed action of the forwarding rules is executed on the received access packet from the target source device. In this way, when an access packet is received, this application can determine the forwarding rule corresponding to the access packet based on the identifier mapping table and the access permission matching table, without needing to match the access packet with the ACL deployed in the TCAM to determine the corresponding forwarding rule. Since the identifier mapping table and the access permission matching table do not need to be deployed in the TCAM, a large-capacity TCAM is not required to meet the deployment requirements of the identifier mapping table and the access permission matching table. This can reduce the cost of deploying access control policies for terminal access servers and improve the efficiency of determining the forwarding rules corresponding to access packets.

[0137] One possible implementation, prior to S201 above, includes: generating an identifier mapping table and an access permission matching table based on the obtained access control policy, and deploying the identifier mapping table and the access permission matching table. Here, the access control policy is a port-level access control policy.

[0138] Optionally, network devices can pre-deploy identity mapping tables and access permission matching tables locally based on access control policies indicated by users (e.g., network administrators) in the port-level policy deployment system.

[0139] Optionally, the network device may have local random access memory (RAM), or the network device may have external random access memory. This allows the identifier mapping table and access permission matching table to be deployed in the random access memory.

[0140] It should be noted that random access memory is a low-cost, large-capacity on-chip memory. Specifically, random access memory can be a low-cost device such as static random access memory (SRAM) or off-chip synchronous dynamic random access memory (SDRAM).

[0141] For example, as shown in Table 1 (three policies are shown), the obtained access control policies can include access control policies between multiple source devices and multiple destination devices. Each control policy includes: source IP, source port, destination IP, destination port and action. The action can be Permit, Deny, or Other.

[0142] Table 1

[0143] Source IP Source Port Destination IP Destination Port Action Strategy 1 IP1 Port1 IP4 Port4 Permit Strategy 2 IP2 Port2 IP5 Port5 Deny Strategy 3 IP3 Port3 IP6 Port6 Other …… …… …… …… …… ……

[0144] One possible implementation is that, based on the obtained access control policy, the above-mentioned generation of the identifier mapping table includes: assigning an address identifier to at least one address corresponding to each of the multiple devices based on the obtained access control policy, generating a first mapping table; and assigning a port identifier to at least one port corresponding to each address based on the first mapping table, generating a second mapping table.

[0145] It should be noted that the source port is the terminal-side protocol port (port range), and the corresponding port number can be randomly assigned from the range of 0-65535, or it can be a specific list of ports (port ranges) specified by the administrator. The destination port can be a port number specified by the administrator.

[0146] Optionally, a globally unique identifier can be assigned to each IP address based on both the source and destination IP addresses. Specifically, the identifier assigned to the source IP address can be uid (i.e., user ID), and the identifier assigned to the destination IP address can be aid (i.e., application ID), thus obtaining the first mapping table, as shown in Table 2.

[0147] Table 2

[0148] IP Address Identifier Source IP1 uid1 Source IP2 uid2 Destination IP1 aid1 …… ……

[0149] Then, based on each address identifier, a globally unique identifier is assigned to the specific port (port segment) associated with that address identifier. Specifically, for a specific source port (port segment) associated with uid, such as source port1, the port identifier upid1 can be assigned; similarly, for a specific destination port (port segment) associated with aid, such as destination port4, the port identifier apid4 can be assigned, thus obtaining the second mapping table, as shown in Table 3.

[0150] Table 3

[0151]

[0152] One possible implementation is that, when the port number is a continuous range of port numbers, multiple port numbers within that range correspond to the same port identifier.

[0153] It is understandable that mapping consecutive port segments to identifiers and using the mapped port identifiers for rule matching can avoid the problem of policy bloat caused by directly matching rules using the port (or port segment) itself, and can reduce the cost of policy deployment.

[0154] For example, assuming a source port corresponds to port number 5000-6000, and the port identifier for this port is upid6, then it can be assumed that the port identifiers corresponding to the 1001 port numbers included in port number 5000-6000 are all upid6. This eliminates the need to assign port identifiers to each of the 1001 port numbers included in port number 5000-6000 individually, resulting in 1001 port identifiers. This helps to suppress the problem of policy bloat.

[0155] In this way, for a continuous range of port numbers, there is no need to split the continuous range of port numbers into individual port numbers; instead, a port identifier is assigned to each port number. This reduces the workload of assigning port identifiers and improves the efficiency of determining port identifiers later.

[0156] One possible implementation involves generating an access permission matching table based on the obtained access control policy, including: determining the correspondence between multiple identifier groups and forwarding rules based on the obtained access control policy, the first mapping table, and the second mapping table, and generating the access permission matching table.

[0157] For example, by combining the address identifiers and port identifiers shown in Tables 2 and 3 above, and according to the policy shown in Table 1, the access permission matching table shown in Table 4 can be obtained.

[0158] Table 4

[0159] Identification group Forwarding rules Rule 1 upid1+upid4 Permit Rule 2 upid2+upid5 Deny Rule 3 upid3+upid6 Other

[0160] In other words, this application, based on access control policies, can assign address identifiers to the addresses corresponding to each device and port identifiers to the ports corresponding to each address, thereby obtaining a corresponding identifier mapping table. Then, based on the identifier mapping table and access control policies, the correspondence between multiple identifier groups and forwarding rules can be determined, resulting in an access permission matching table, which can then be deployed. Since the identifier mapping table and access permission matching table do not need to be deployed in the TCAM, a large-capacity TCAM is not required to meet the deployment needs of the identifier mapping table and access permission matching table. This reduces the cost of deploying access control policies for terminal access to the server.

[0161] One possible implementation is that each forwarding rule in the access permission matching table includes: a first protocol type and a first data transmission direction, and the access message also includes: a second protocol type and a second data transmission direction; the aforementioned actions for performing the forwarding rules on the access message include: determining whether the first protocol type and the second protocol type match, and whether the first data transmission direction and the second data transmission direction match; so that if both the protocol type and the data transmission direction match, the actions for performing the forwarding rules on the access message are performed.

[0162] It is understandable that in a network device port-level policy deployment system, more matching elements, such as protocol type and flow direction, can be introduced into the access permission matching table to enhance the security of the source device accessing the destination device, as shown in Table 5.

[0163] Table 5

[0164] Identification group Forwarding rules Rule 1 upid1+upid4+protocol+flow direction Permit Rule 2 upid2+upid5+protocol+flow direction Deny Rule 3 upid3+upid6+protocol+flow direction Other

[0165] Therefore, when the system parses access packets for port-level policy deployment on network devices, in addition to obtaining the source address, source port, destination address, and destination port, it is also necessary to parse and determine the corresponding protocol type and traffic direction.

[0166] Therefore, after determining the forwarding rules corresponding to the access message, we can further determine the protocol type and data transmission direction of the access message to ascertain whether the access message matches the forwarding rules. Only when both the protocol type and data transmission direction match will the prescribed action of the forwarding rules be executed on the access message. This further improves the accuracy of determining the forwarding rules corresponding to the access message based on the protocol type and data transmission direction.

[0167] In a specific embodiment, such as Figure 4As shown, in conjunction with the deployment process of the access control policy described above, a specific implementation of the access control method is illustrated. First, network administrators configure port-level rule configuration commands (i.e., access control policies) for terminal access to application services in network devices. The network devices then parse these port-level rule configuration commands through the control module, constructing an identifier mapping table and an access permission matching table. The control module then distributes these tables to the forwarding module for storage. When a source device sends an access packet to the application service of a destination device, the network device obtains the access information (source address, destination address, and destination port) from the access packet through the forwarding module and matches it against the identifier mapping table and the access permission matching table. If a corresponding forwarding rule is found in either table, the access packet is forwarded based on that rule; otherwise, the access packet is discarded or subjected to special processing.

[0168] For example, taking a source device accessing a destination device as an example, the access control policy obtained for the source device to access the destination device is shown in Table 6. The source IP is 10.10.10.1, the source port is unrestricted and can be any port (Any), the destination IP is 100.100.1.1, the destination port can be 80, 8080 or 6000-10000, and the action is Permit.

[0169] It's understandable that a source device can access a destination device through any port, so there's no need to restrict the source port. However, in certain specific situations, it's possible to restrict the port the source device can access the destination device, for example, by setting the source port to 100.

[0170] Table 6

[0171]

[0172] Thus, based on the access control policy for source devices accessing destination devices shown in Table 6, address identifiers are assigned to the source IP and destination IP, resulting in the first mapping table (address identifier mapping table) shown in Table 7. The address identifier corresponding to the source IP is id1, and the address identifier corresponding to the destination IP is id2.

[0173] Table 7

[0174] IP Address Identifier 10.10.10.1 id1 100.100.1.1 id2

[0175] Then, based on the address identifiers corresponding to the source IP and the destination IP, port identifiers are assigned to the ports associated with the source IP and the ports associated with the destination IP, resulting in the second mapping table (port identifier mapping table) shown in Table 8. Specifically, the port identifier corresponding to port 80 associated with the destination IP is 1000, the port identifier corresponding to port 8080 associated with the destination IP is 1001, the port identifier corresponding to ports 6000-10000 associated with the destination IP is 1002, and the port identifier corresponding to port Any associated with the source IP is 1003.

[0176] Table 8

[0177]

[0178] Therefore, based on the access control policy shown in Table 6, the first mapping table shown in Table 7, and the second mapping table shown in Table 8, the access permission matching table shown in Table 9 can be obtained.

[0179] Table 9

[0180] Identification group Forwarding rules Rule 1 1003+1000 Permit Rule 2 1003+1001 Permit Rule 3 1003+1002 Permit

[0181] In summary, the access control method provided in this application can replace the expensive, power-consuming, and limited-specification TCAM with a low-cost, high-capacity memory, achieving the effect of low cost, low power consumption, high capacity, and support for the deployment of massive access control policies. It replaces the TCAM-type full rule set matching method with a table lookup method (identifier mapping table and access permission matching table), eliminating the need for TCAM-type devices and enabling forwarding rule matching using ordinary RAM-type devices that do not support concurrent matching. Furthermore, it can match a unified port identifier for consecutive port number ranges, solving the problem of policy splitting and rule number expansion caused by TCAM-type mask matching limitations, and further controlling and compressing the total number of port-level policies.

[0182] The above primarily describes the solutions provided in the embodiments of this application from the perspective of network devices. It is understood that, in order to achieve the above functions, network devices include corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the steps of an access control method described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by software-driven hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0183] This application embodiment can divide the network device into functional modules or functional units according to the above method examples. For example, each function can be divided into a separate functional module or functional unit, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or in software functional modules or functional units. The module or unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0184] This application provides a schematic diagram of an access control device, such as... Figure 5 As shown, the access control device 500 may include a receiving module 501 and a processing module 502.

[0185] The receiving module 501 is configured by the access control device 500 to receive an access message sent by the target source device, the access message including a source address, a source port, a destination address, and a destination port. For example, the receiving module 501 is used to support the access control device 500 in executing S301 in the above method embodiment, and / or other processes of the technology described herein.

[0186] The aforementioned processing module 502 is used by the access control device 500 to perform the following: based on the source address, source port, destination address, and destination port, querying the port identifiers corresponding to the source port and destination port in an identifier mapping table; the identifier mapping table includes the correspondence between the source address, source port, and port identifier, as well as the correspondence between the destination address, destination port, and port identifier. For example, the processing module 502 is used to support the access control device 500 in performing S302 in the above method embodiment, and / or other processes used in the technology described herein.

[0187] The aforementioned processing module 502 is further configured to allow the access control device 500 to perform: querying a forwarding rule in an access permission matching table based on the port identifiers corresponding to the source and destination ports; the access permission matching table includes the correspondence between the port identifiers corresponding to the source and destination ports and the forwarding rules. For example, the processing module 502 is configured to support the access control device 500 in performing S303 in the above method embodiment, and / or other processes used in the technology described herein.

[0188] The aforementioned processing module 502 is also used by the access control device 500 to perform the prescribed actions of forwarding rules on access packets. For example, the processing module 502 is used to support the access control device 500 in performing S304 in the above method embodiments, and / or other processes used in the technology described herein.

[0189] In one possible design approach, the identifier mapping table includes a correspondence between multiple ports and port identifiers, and a correspondence between multiple addresses and address identifiers, with a correspondence between multiple ports and multiple addresses, and each address corresponding to at least one port.

[0190] In another possible design, the identifier mapping table includes a first mapping table and a second mapping table; the first mapping table includes the correspondence between addresses and address identifiers; the second mapping table includes the correspondence between address identifiers, ports, and port identifiers.

[0191] In another possible design, the aforementioned processing module 502 is specifically used to query the address identifier corresponding to the source address and the address identifier corresponding to the destination address in the first mapping table based on the source address and the destination address.

[0192] The aforementioned processing module 502 is specifically used to query the port identifier corresponding to the source port in the second mapping table based on the address identifier corresponding to the source port and the source address.

[0193] The aforementioned processing module 502 is specifically used to query the port identifier corresponding to the destination port in the second mapping table based on the address identifier corresponding to the destination port and the destination address.

[0194] In another possible design approach, the access permission matching table includes a mapping between identifier groups and forwarding rules, where each identifier group includes a port identifier corresponding to the source port and a port identifier corresponding to the destination port.

[0195] In another possible design, the aforementioned processing module 502 is specifically used to determine a target identifier group that includes the port identifiers corresponding to the source port and the destination port from the access permission matching table based on the port identifiers corresponding to the source port and the destination port.

[0196] The aforementioned processing module 502 is specifically used to determine the forwarding rule corresponding to the target identifier group from the access permission matching table.

[0197] In another possible design, the aforementioned processing module 502 is further configured to generate an identifier mapping table and an access permission matching table based on the acquired access control policy, wherein the access control policy is a port-level access control policy.

[0198] The aforementioned processing module 502 is also used to deploy the identifier mapping table and the access permission matching table.

[0199] In another possible design, the aforementioned processing module 502 is specifically used to assign an address identifier to at least one address corresponding to each of the multiple devices based on the obtained access control policy, and generate a first mapping table.

[0200] The aforementioned processing module 502 is specifically used to assign a port identifier to at least one port corresponding to each address based on the first mapping table, and generate a second mapping table.

[0201] In another possible design, the aforementioned processing module 502 is specifically used to determine the correspondence between multiple identifier groups and forwarding rules based on the obtained access control policy, the first mapping table, and the second mapping table, and to generate an access permission matching table.

[0202] In another possible design approach, where the port number is a consecutive range of port numbers, multiple port numbers within that consecutive range correspond to the same port identifier.

[0203] In another possible design, each forwarding rule in the access permission matching table includes: a first protocol type and a first data transmission direction, and the access message also includes: a second protocol type and a second data transmission direction.

[0204] The aforementioned processing module 502 is specifically used to determine whether the first protocol type and the second protocol type match, and whether the first data transmission direction and the second data transmission direction match.

[0205] The aforementioned processing module 502 is specifically used to perform the prescribed actions of the forwarding rules on the access message when both the protocol type and the data transmission direction are matched.

[0206] As an example of a software functional unit, processing module 502 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, processing module 502 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0207] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0208] As an example of a hardware functional unit, the processing module 502 may include at least one computing device, such as a server. Alternatively, the processing module 502 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0209] The processing module 502 includes multiple computing devices that can be distributed within the same region or in different regions. Similarly, the processing module 502 includes multiple computing devices that can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the processing module 502 includes multiple computing devices that can be distributed within the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0210] This application also provides an access control system 600, such as... Figure 6 As shown, the device includes a source device 601, a network device 602, and a destination device 603. All three devices can be implemented in software or hardware. For example, the implementation of network device 602 will be described below. Similarly, the implementation of source device 601 and destination device 603 can be referenced from the implementation of network device 602.

[0211] As an example of a software functional unit, network device 602 may include code running on a computing instance. This computing instance can be at least one of a physical host (computing device), a virtual machine, a container, or other computing devices. Furthermore, the aforementioned computing device may be one or more. For example, network device 602 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the application can be distributed within the same region or in different regions. The multiple hosts / virtual machines / containers used to run the code can be distributed within the same Availability Zone (AZ) or in different AZs, each AZ including one data center or multiple geographically proximate data centers. Typically, a region may include multiple AZs.

[0212] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same VPC or across multiple VPCs. Typically, a VPC is set up within a single region. Communication between two VPCs within the same region, and between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0213] As an example of a hardware functional unit, network device 602 may include at least one computing device, such as a server. Alternatively, network device 602 may also be a device implemented using an ASIC or a PLD. The aforementioned PLD may be implemented using a CPLD, FPGA, GAL, or any combination thereof.

[0214] The network device 602 includes multiple computing devices that can be distributed within the same region or in different regions. Similarly, the network device 602 includes multiple computing devices that can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the network device 602 includes multiple computing devices that can be distributed within the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0215] This application also provides a network device 700. For example... Figure 7 As shown, network device 700 includes: bus 701, processor 702, memory 703, and communication interface 704. Processor 702, memory 703, and communication interface 704 communicate via bus 701. Network device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in network device 700.

[0216] The 701 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus 701 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 701 may include a path for transmitting information between various components of the network device 700 (e.g., memory 703, processor 702, communication interface 704).

[0217] Processor 702 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0218] The memory 703 may include volatile memory, such as random access memory (RAM). The processor 702 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0219] The memory 703 stores executable program code, and the processor 702 executes the executable program code to implement the functions of the aforementioned receiving module 501 and processing module 502, thereby realizing the control method. That is, the memory 703 stores instructions for executing the control method.

[0220] The communication interface 704 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the network device 700 and other devices or communication networks.

[0221] This application also provides a network device cluster. The network device cluster includes at least one network device. The network device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the network device can also be a terminal device such as a desktop computer, laptop computer, or smartphone.

[0222] like Figure 8 As shown, the network device cluster includes at least one network device 700. The memory 703 of one or more network devices 700 in the network device cluster may store the same instructions for executing control methods.

[0223] In some possible implementations, the memory 703 of one or more network devices 700 in the network device cluster may also store partial instructions for executing the control method. In other words, a combination of one or more network devices 700 can jointly execute the instructions for executing the control method.

[0224] It should be noted that the memory 703 in different network devices 700 within the network device cluster can store different instructions, each used to execute a portion of the control device's functions. That is, the instructions stored in the memory 703 of different network devices 700 can implement the functions of one or more modules in the receiving module 501 and processing module 502.

[0225] In some possible implementations, one or more network devices in a network device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 One possible implementation is shown. For example... Figure 9 As shown, two network devices 700A and 700B are connected via a network. Specifically, they are connected to the network through the communication interfaces in each network device. In this possible implementation, the memory 703 in network device 700A stores instructions for executing the functions of the receiving module 501. Simultaneously, the memory 703 in network device 700A stores instructions for executing the functions of the receiving module 501, and the memory 703 in network device 700B stores instructions for executing the functions of the processing module 502.

[0226] Figure 9 The connection method between the network device clusters shown can be such that, considering the control method provided in this application requires a large amount of data storage and transmission, the functions implemented by the processing module 502 are delegated to the network device 700B.

[0227] It should be understood that Figure 9 The functions of network device 700A shown can also be performed by multiple network devices 700. Similarly, the functions of network device 700B can also be performed by multiple network devices 700.

[0228] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a network device or stored on any usable medium. When the computer program product is run on at least one network device, it causes the at least one network device to perform a control method.

[0229] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a network device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the network device to perform a control method.

[0230] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

[0231] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0232] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0233] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0234] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0235] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0236] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An access control method characterized by, The method comprises: receiving an access message sent by a target source device, the access message comprising: a source address, a source port, a destination address and a destination port; querying a port identifier corresponding to the source port and the destination port in an identifier mapping table based on the source address, the source port, the destination address and the destination port; the identifier mapping table comprising a corresponding relationship between the source address, the source port and the port identifier, and a corresponding relationship between the destination address, the destination port and the port identifier; querying a forwarding rule in an access permission matching table based on the port identifier corresponding to the source port and the destination port; the access permission matching table comprising a corresponding relationship between the port identifier corresponding to the source port and the destination port and the forwarding rule; performing a specified action of the forwarding rule on the access message.

2. The method of claim 1, wherein, The identifier mapping table comprises a corresponding relationship between a plurality of ports and port identifiers, and a corresponding relationship between a plurality of addresses and address identifiers, and there is a corresponding relationship between the plurality of ports and the plurality of addresses, and each address corresponds to at least one port.

3. The method of claim 2, wherein, The identifier mapping table comprises a first mapping table and a second mapping table; The first mapping table comprises a corresponding relationship between an address and an address identifier; The second mapping table comprises a corresponding relationship between an address identifier, a port and a port identifier.

4. The method of claim 3, wherein, The querying of the port identifier corresponding to the source port and the destination port in the identifier mapping table based on the source address, the source port, the destination address and the destination port comprises: querying an address identifier corresponding to the source address and an address identifier corresponding to the destination address in the first mapping table based on the source address and the destination address; querying a port identifier corresponding to the source port in the second mapping table based on the source port and the address identifier corresponding to the source address; querying a port identifier corresponding to the destination port in the second mapping table based on the destination port and the address identifier corresponding to the destination address.

5. The method according to any one of claims 1-4, characterized in that, The access permission matching table comprises a corresponding relationship between an identifier group and a forwarding rule, and each identifier group comprises a port identifier corresponding to a source port and a port identifier corresponding to a destination port.

6. The method of claim 5, wherein, The querying of the forwarding rule in the access permission matching table based on the port identifier corresponding to the source port and the destination port comprises: determining a target identifier group comprising the port identifier corresponding to the source port and the destination port from the access permission matching table based on the port identifier corresponding to the source port and the destination port; determining a forwarding rule corresponding to the target identifier group from the access permission matching table.

7. The method of claim 1, wherein, Before the receiving of the access message sent by the target source device, the method further comprises: generating the identifier mapping table and the access permission matching table based on an acquired access control policy, the access control policy being a port-level access control policy; deploying the identifier mapping table and the access permission matching table.

8. The method of claim 7, wherein, The generating of the identifier mapping table based on the acquired access control policy comprises: allocating an address identifier to at least one address corresponding to each device in a plurality of devices based on the acquired access control policy, to generate a first mapping table; Generate a second mapping table based on the first mapping table, which assigns a port identifier to each address pair corresponding to at least one port.

9. The method of claim 8, wherein, The access permission matching table is generated based on the obtained access control policy, the first mapping table, and the second mapping table. The access permission matching table is generated based on the obtained access control policy, the first mapping table, and the second mapping table.

10. The method of claim 8, wherein, In the case of a continuous port number interval, the continuous port number interval includes a plurality of port numbers corresponding to the same port identifier.

11. The method of claim 1, wherein, The access permission matching table includes a first protocol type and a first data transmission direction, and the access message also includes a second protocol type and a second data transmission direction. The access permission matching table includes a first protocol type and a first data transmission direction, and the access message also includes a second protocol type and a second data transmission direction. The access permission matching table includes a first protocol type and a first data transmission direction, and the access message also includes a second protocol type and a second data transmission direction. The access control device includes:

12. An access control device, characterized by A receiving module configured to receive an access message sent by a target source device, the access message including a source address, a source port, a destination address, and a destination port. A processing module configured to query a port identifier corresponding to the source port and the destination port in an identifier mapping table based on the source address, the source port, the destination address, and the destination port; the identifier mapping table including a correspondence between the source address, the source port, and the port identifier, and a correspondence between the destination address, the destination port, and the port identifier. The processing module is further configured to query a forwarding rule in an access permission matching table based on the port identifier corresponding to the source port and the destination port; the access permission matching table including a correspondence between the port identifier corresponding to the source port and the destination port and the forwarding rule. The processing module is further configured to perform a specified action of the forwarding rule on the access message. The network device includes a memory and a processor, the memory being coupled to the processor; the memory is configured to store computer program code, the computer program code including computer instructions; when the computer instructions are executed by the processor, the network device performs the method of any one of claims 1-11.

13. A network device, comprising: The computer program instructions are executed by the network device, and the network device performs the method of any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The instructions are executed by the network device, and the network device performs the method of any one of claims 1-11.

15. A computer program product comprising instructions, characterized in that, ​

Images