Networking method of federated network target range and related equipment

Abstract

The embodiment of the invention provides a federated network target range networking method and related equipment, and the method comprises the steps: responding to an attack and defense networking request, building a first communication link between a source terminal target range where an attack terminal is located and a master control target range, and building a second communication link between a target terminal target range where a target terminal is located and the master control target range; respectively constructing a first logic interface corresponding to the first communication link and a second logic interface corresponding to the second communication link in a centralized routing cluster of the master control target range; configuring a first main IP address on the first logic interface and a second main IP address on the second logic interface respectively based on the network configuration information of the attack end and the target end; according to the method, the virtual routing forwarding instance is created, the first logic interface and the second logic interface are bound to the routing domain of the virtual routing forwarding instance, and the cross-domain forwarding path from the first logic interface to the second logic interface is established, so that the networking flexibility, applicability and reliability of the federated network target range are improved.

Description

Technical Field

[0001] This application relates to the field of network configuration data processing technology, and in particular to networking methods and related equipment for federal network ranges. Background Technology

[0002] With the increasing demand for realistic cybersecurity training, federated network ranges, as a special form of distributed range, are gradually becoming a key infrastructure supporting large-scale cross-domain attack and defense exercises. In related technologies, to achieve interconnection between different regional ranges, a large Layer 2 interconnection technology based on a Hub-Spoke architecture (such as VLAN combined with VXLAN over WireGuard) is typically adopted. This involves establishing tunnels through NAT via interconnection access gateways, enabling cross-domain roaming and secure isolation of network nodes while ensuring the independent operation of each range.

[0003] However, this networking scheme based on large Layer 2 interconnection has strong correlations between tunnel configuration parameters in each sub-field (such as the need to configure the same Layer 2 bridge domain), making it difficult for each sub-field to perform independent network control. At the same time, due to the lack of centralized management of Layer 3 routing functions, this scheme can only achieve interconnection within the same network segment, cannot support the attack access needs across network segments, and is also difficult to solve the IP address conflict problem when multiple targets coexist. This results in low applicability and reliability of the existing networking method. Summary of the Invention

[0004] This application provides a networking method and related equipment for a federal network range, which can improve the applicability and reliability of network range networking.

[0005] To achieve the above objectives, a first aspect of this application proposes a networking method for a federated network range, the method comprising: In response to the attack and defense networking request, a first communication link is established between the source target range where the attacking end is located and the main control target range, and a second communication link is established between the destination target range where the target end is located and the main control target range. In the centralized routing cluster of the main control range, a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link are respectively constructed. Based on the network configuration information of the attacking end, a first primary IP address is configured on the first logical interface, and based on the network configuration information of the target end, a second primary IP address is configured on the second logical interface. Create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

[0006] In some embodiments, establishing a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address includes: In the virtual routing forwarding instance, a routing table entry is generated, which indicates that a data packet with the source address of the first primary IP address should be directed to a link with the second logical interface as the next hop. A source network address translation strategy is applied to the second logical interface to use the second primary IP address as the translated source address to perform address replacement processing on data packets directed to the second logical interface via the routing table entry, thereby obtaining the cross-domain forwarding path from the first logical interface to the target end.

[0007] In some embodiments, establishing a first communication link between the source range where the attacking end is located and the master control range, and establishing a second communication link between the destination range where the target end is located and the master control range, includes: Obtain the first virtual local area network (VLAN) tag configured on the interconnection access gateway of the source target range, and obtain the second virtual local area network (VLAN) tag configured on the interconnection access gateway of the destination target range; Based on the first virtual LAN tag, data packets are encapsulated using the Virtual Extended LAN protocol, and a first encrypted tunnel from the source target range to the master control target range is established through the encrypted tunnel protocol. Based on the second virtual LAN tag, data packets are encapsulated using the virtual extended LAN protocol, and a second encrypted tunnel is established from the destination target range to the master control target range through the encrypted tunnel protocol. The first encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the first communication link, and the second encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the second communication link.

[0008] In some embodiments, configuring a first primary IP address on the first logical interface based on the network configuration information of the attacking terminal includes: Based on the network configuration information of the attacking terminal, the source network segment where the attacking terminal is located is determined, and an unoccupied first IP address is selected from the source network segment; Configure the first IP address as the first primary IP address of the first logical interface, and specify the first primary IP address as the default next-hop address for the attacker to access the master control target range.

[0009] In some embodiments, creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense networking request indicates that a single attacking end accesses a single target end, a virtual routing forwarding instance corresponding to and isolated from the access relationship is created; The first logical interface and the second logical interface are associated with the routing table of the virtual route forwarding instance to establish a logical connection between the first logical interface and the second logical interface within the same routing domain; An access control list is generated based on the source IP network segment of the attacking end, and the access control list is sent to the second logical interface so that the second logical interface can perform source address validity verification on the data traffic entering the second logical interface based on the cross-domain forwarding path.

[0010] In some embodiments, creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense network request indicates that multiple attack terminals access the same target terminal at the same time, a corresponding independent attack terminal virtual routing forwarding instance is created for each attack terminal, and an independent target terminal virtual routing forwarding instance is created for the target terminal. The virtual routing forwarding instance includes multiple attack terminal virtual routing forwarding instances and target terminal virtual routing forwarding instances. Associate the first logical interface corresponding to each of the attacking ends with the corresponding virtual routing and forwarding instance of the attacking end, and associate the second logical interface with the virtual routing and forwarding instance of the target end; In each of the attack-side virtual routing forwarding instances, a destination network address translation rule is generated. The destination network address translation rule is used to direct the next hop of the data traffic to the target-side virtual routing forwarding instance while keeping the destination IP address of the data traffic unchanged.

[0011] In some embodiments, creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense network request indicates that the attacking end accesses multiple target ends with conflicting IP addresses at the same time, a target virtual route forwarding instance corresponding to each target end is created; Bind the second logical interface corresponding to each target terminal to the corresponding target virtual routing forwarding instance; Assign a corresponding virtual destination IP address to each of the target terminals; A destination network address translation rule is generated, and the destination network address translation rule is sent to the attack virtual routing forwarding instance associated with the attacking end, so that the attack virtual routing forwarding instance converts the access request for the virtual destination IP address into the access request for the real IP address of the conflicting target end, and directs the data traffic to the corresponding target virtual routing forwarding instance. The virtual routing forwarding instance includes multiple target virtual routing forwarding instances and the attack virtual routing forwarding instance.

[0012] To achieve the above objectives, a second aspect of this application provides a networking apparatus for a federated network range, the apparatus comprising: The link construction module is used to respond to the attack and defense networking request, establish a first communication link between the source target range where the attacking end is located and the main control target range, and establish a second communication link between the destination target range where the target end is located and the main control target range. The interface configuration module is used to construct a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link in the centralized routing cluster of the main control range. The address configuration module is used to configure a first primary IP address on the first logical interface based on the network configuration information of the attacking end, and to configure a second primary IP address on the second logical interface based on the network configuration information of the target end. The routing orchestration module is used to create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

[0013] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the networking method for the federated network range as described in the first aspect.

[0014] To achieve the above objectives, a fourth aspect of the present application provides a storage medium, which is a computer-readable storage medium storing a computer program that, when executed by a processor, implements the networking method for the federated network range described in the first aspect.

[0015] The networking method and related equipment for the federated network test range proposed in this application include: First, in response to an attack and defense networking request, establishing a first communication link between the source test range where the attacker is located and the master control test range, and establishing a second communication link between the destination test range where the target is located and the master control test range; then, in the centralized routing cluster of the master control test range, constructing a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link; subsequently, configuring a first primary IP address on the first logical interface based on the network configuration information of the attacker, and configuring a second primary IP address on the second logical interface based on the network configuration information of the target; finally, creating a virtual routing forwarding instance corresponding to the networking request, binding the first and second logical interfaces to the routing domain of the corresponding virtual routing forwarding instance, and establishing a cross-domain forwarding path from the first logical interface to the second logical interface based on the first and second primary IP addresses. This application embodiment constructs a centralized routing cluster in the main control range, establishing independent communication links and logical interfaces from the source and destination ends to the main control end in response to attack and defense requests. It utilizes Virtual Router Forwarding Instances (VRFs) for logical isolation and routing orchestration, breaking the traditional limitations of large Layer 2 interconnection on the same network segment. It achieves flexible access across network segments using Layer 3 routing technology. At the same time, by decoupling physical access from logical networking, it effectively eliminates the strong correlation of tunnel configurations between sub-ranges, supports concurrent access and time-sharing control in scenarios with multiple target IP address conflicts, and thus significantly improves the networking flexibility, applicability, and network control reliability of the federated network range in complex attack and defense exercise scenarios.

[0016] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a large Layer 2 interconnection access provided in one embodiment of this application.

[0018] Figure 2 This is another embodiment of the present application, providing a cross-domain target networking design concept and data flow diagram for a federal network range.

[0019] Figure 3This is a schematic diagram of a segmented configuration provided in another embodiment of this application.

[0020] Figure 4 This is a flowchart of a networking method for a federal network range provided in another embodiment of this application.

[0021] Figure 5 yes Figure 4 The flowchart for step 401.

[0022] Figure 6 yes Figure 4 The flowchart for step 403.

[0023] Figure 7 This is a schematic diagram illustrating the connection between an attacker located in a sub-targeting range and the main control range, provided in another embodiment of this application.

[0024] Figure 8 This is a schematic diagram of an attacker configuration located in the main target range, provided in another embodiment of this application.

[0025] Figure 9 This is a schematic diagram of the connection between a target located in a sub-targeting range and a main control target range, provided in another embodiment of this application.

[0026] Figure 10 This is a schematic diagram of a target configuration located in the main target range, provided in another embodiment of this application.

[0027] Figure 11 This is a schematic diagram of an access relationship provided in another embodiment of this application.

[0028] Figure 12 This is a flowchart of creating a virtual route forwarding instance for a one-to-one access relationship, provided in another embodiment of this application.

[0029] Figure 13 This is a schematic diagram of a one-to-one access relationship network construction provided in another embodiment of this application.

[0030] Figure 14 This is a flowchart of creating a virtual route forwarding instance for a many-to-one access relationship, provided in another embodiment of this application.

[0031] Figure 15 This is a schematic diagram of a many-to-one access relationship network construction provided in another embodiment of this application.

[0032] Figure 16 This is a schematic diagram of the internal network of a target provided in another embodiment of this application.

[0033] Figure 17 This is a flowchart of an example of creating a virtual route forwarding instance for access relationships with conflicting IP addresses, provided in another embodiment of this application.

[0034] Figure 18 This is a schematic diagram of a target IP conflict provided in another embodiment of this application.

[0035] Figure 19 This is a schematic diagram of multi-segment target access provided in another embodiment of this application.

[0036] Figure 20 This is a schematic diagram of a routing and forwarding scenario provided in another embodiment of this application.

[0037] Figure 21 This is a flowchart illustrating the creation of a cross-domain forwarding path according to another embodiment of this application.

[0038] Figure 22 This is a schematic diagram of the networking process of a federal network range provided in another embodiment of this application.

[0039] Figure 23 This is a schematic diagram of a three-layer network construction scheme that supports cross-domain multi-target attacks and offensive-defensive confrontation, provided by another embodiment of this application.

[0040] Figure 24 This is a schematic diagram of the networking device for a federal network range provided in another embodiment of this application.

[0041] Figure 25 This is a schematic diagram of the hardware structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0043] It should be noted that although functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0045] With the increasing demand for realistic cybersecurity training, federated network ranges, as a special form of distributed range, are gradually becoming a key infrastructure supporting large-scale cross-domain attack and defense exercises. In related technologies, to achieve interconnection between different regional ranges, a large Layer 2 interconnection technology based on a Hub-Spoke architecture (such as VLAN combined with VXLAN over WireGuard) is typically adopted. This involves establishing tunnels through NAT via interconnection access gateways, enabling cross-domain roaming and secure isolation of network nodes while ensuring the independent operation of each range.

[0046] Reference Figure 1 This is a schematic diagram of a large Layer 2 interconnection access provided in an embodiment of this application. For example... Figure 1 The diagram illustrates a large Layer 2 interconnection access scheme based on a Hub-Spoke architecture in existing technology. Sub-target A (attacker) and sub-target B (target) access the main control target's interconnection gateway device via the Internet. This architecture employs VLANs combined with VXLAN over WireGuard technology. The attacker, target, and main control terminals must be configured in the exact same Layer 2 bridge domain (e.g., ...). Figure 1 Interoperability can only be achieved under the bridge-domain 100 shown. Although this strongly coupled networking method achieves basic cross-domain connectivity, it also exposes the technical limitations of each sub-field being difficult to control independently and unable to support cross-network segment routing access.

[0047] This networking scheme based on large Layer 2 interconnection has strong correlations between tunnel configuration parameters in each sub-field (such as the need to configure the same Layer 2 bridge domain), making it difficult for each sub-field to perform independent network control. At the same time, due to the lack of centralized management of Layer 3 routing functions, this scheme can only achieve interconnection within the same network segment, cannot support the attack access needs across network segments, and is also difficult to solve the IP address conflict problem when multiple targets coexist. This results in low applicability and reliability of the existing networking method.

[0048] To improve the applicability and reliability of network range networking, this application embodiment constructs a centralized routing cluster in the main control range. In response to attack and defense requests, it establishes independent communication links and logical interfaces from the source and destination ends to the main control end. It also uses Virtual Router Forwarding Instances (VRFs) for logical isolation and routing orchestration, breaking the traditional limitations of large Layer 2 interconnection on the same network segment. It uses Layer 3 routing technology to achieve flexible access across network segments. At the same time, by decoupling physical access from logical networking, it effectively eliminates the strong correlation of tunnel configurations between sub-ranges, supports concurrent access and time-sharing control in scenarios with multiple target IP address conflicts, and thus significantly improves the networking flexibility, applicability, and network control reliability of the federated network range in complex attack and defense exercise scenarios.

[0049] Reference Figure 2 This is a schematic diagram illustrating a cross-domain target networking design concept and data flow for a federated network range, provided in an embodiment of this application. Figure 2 The diagram illustrates a distributed network architecture consisting of a "master control range" (Hub end, i.e., the master control range) and "sub-range A" (attack end) and "sub-range B" (target end). This differs from existing technologies (i.e., as...). Figure 1 As shown in the diagram, sub-range A and sub-range B are connected via different VXLAN bridge domains ( Figure 2 The diagram shows the "gateway cluster" (VXLAN bridge-domains 100 and 101) traversing the internet access main control range, decoupling the access configurations of each sub-range. The main control range deploys a core "router cluster" (including routers R1 and R2) to centrally manage Layer 3 routing and forwarding logic. The red and purple arrows clearly depict the "three-stage" cross-domain access path: attack traffic first travels from sub-range A to the main control range via the interconnection access gateway (path 1); then, the traffic is mapped to internal VLANs (ranges 200-201) and directed to the router cluster for centralized routing calculation and address translation (path 2); the processed traffic is then injected back into the gateway cluster (path 3), and finally distributed to sub-range B via the corresponding tunnel (path 4), thus achieving flexible attack and defense networking across network segments and regions.

[0050] Reference Figure 3 This is a schematic diagram of a segmented configuration provided in an embodiment of this application. For example... Figure 3 The diagram shows a schematic of the "segmented configuration" logical architecture for cross-domain target networking in a federated network range. Figure 3 The overall network structure is clearly divided into three independent configuration segments by two vertical dotted lines: the left segment, "Initiator Configuration," shows the attacker (initiator) in sub-field S1 establishing a connection with the main control field through the interconnection access gateway and VXLAN bridge domain 100; the right segment, "Receiver Configuration," shows the target (receiver) in sub-field S2 establishing a connection with the main control field through its gateway and VXLAN bridge domain 101; the middle segment, the core "Access Relationship Establishment," shows the "gateway cluster" aggregating traffic from both sides and directing it to the "router cluster" for Layer 3 routing configuration. This three-segment design intuitively reflects the idea of ​​decoupling physical access from logical control in this invention. That is, the attacker and the target only need to ensure connectivity with the main control field (the first two segments), while the specific attack and defense access relationship between the two is flexibly defined and controlled by the centralized router cluster in the middle (the third segment).

[0051] Based on this, the networking method and related equipment of the federated network range provided in the embodiments of this application will be further described below. The networking method of the federated network range provided in the embodiments of this application can be applied to any processing system with computing resources (such as smart terminals, servers, computers, etc.).

[0052] Reference Figure 4 This is an optional flowchart of the networking method for the federal network range provided in the embodiments of this application. Figure 4 The method may include, but is not limited to, steps 401 to 404. It is also understood that this embodiment... Figure 4 The order of steps 401 to 404 is not specifically limited. The order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0053] Step 401: In response to the attack and defense networking request, establish a first communication link between the source target range where the attacking end is located and the master control target range, and establish a second communication link between the destination target range where the target end is located and the master control target range.

[0054] Step 401 is described in detail below.

[0055] In some embodiments, the system first responds to the attack-defense networking request by establishing a first communication link between the source range where the attacking end is located and the master control range, and a second communication link between the destination range where the target end is located and the master control range. This step mainly involves the construction of physical or logical tunnels. Specifically, the source range and the destination range are usually distributed in different geographical locations. Based on the Hub-Spoke (star) architecture of the federated network range, a connection needs to be established with the master control range through an interconnection access gateway device traversing the wide area network. During this process, the system obtains the Virtual Local Area Network (VLAN) tags configured on the interconnection access gateways of the source range and the destination range, encapsulates data packets using the Virtual Extended Local Area Network (VXLAN) protocol, and establishes a tunnel using an encrypted tunneling protocol (such as WireGuard). The first and second communication links are the specific manifestations of the above tunnels at the network layer, aiming to provide the underlying Layer 2 network interconnection foundation for subsequent cross-domain access, ensuring that the dispersed range resources can be converged to the master control range for unified scheduling. The following will describe in detail how to construct the first communication link.

[0056] Reference Figure 5 The process includes establishing a first communication link between the source range where the attacking end is located and the master control range, and establishing a second communication link between the destination range where the target end is located and the master control range, including the following steps 501 to 504.

[0057] Step 501: Obtain the first virtual LAN tag configured on the interconnection access gateway of the source target range, and obtain the second virtual LAN tag configured on the interconnection access gateway of the destination target range.

[0058] Step 502: Based on the first virtual LAN label, encapsulate data packets using the Virtual Extended LAN protocol, and establish the first encrypted tunnel from the source target range to the master control target range through the encrypted tunnel protocol.

[0059] Step 503: Based on the second virtual LAN tag, encapsulate data packets using the Virtual Extended LAN protocol, and establish a second encrypted tunnel from the destination target range to the master control target range through the encrypted tunnel protocol.

[0060] Step 504: Map the first encrypted tunnel to the physical port sub-interface of the centralized routing cluster to obtain the first communication link, and map the second encrypted tunnel to the physical port sub-interface of the centralized routing cluster to obtain the second communication link.

[0061] Steps 501 to 504 are described in detail below.

[0062] In some embodiments, firstly, the first VLAN tag configured on the interconnection access gateway of the source target range where the attacker is located, and the second VLAN tag configured on the interconnection access gateway of the destination target range are obtained. This step is the initialization phase for building cross-domain connections, mainly involving the identification and tagging of traffic from physical target ranges scattered in different regions. The interconnection access gateway is a network device deployed at the boundary of the source or destination target range to handle traffic entering and leaving the target range; while the VLAN tag is a unique identifier used to identify specific service flows (such as attack flows or target response flows) in a Layer 2 network. By obtaining these tags, the master target range can accurately distinguish data flows from different sub-target ranges or different roles within the same sub-target range, providing the necessary addressing and isolation basis for subsequent tunnel encapsulation.

[0063] Then, based on the first Virtual LAN tag, data packets are encapsulated using the Virtual Extended LAN Protocol (VXLAN), and a first encrypted tunnel is established from the source target range to the master control target range via an encrypted tunneling protocol. This step utilizes overlay network technology to achieve remote transmission of source traffic. The Virtual Extended LAN Protocol (VXLAN) is a network virtualization technology that encapsulates Layer 2 Ethernet frames in UDP packets, enabling Layer 2 networks to extend across Layer 3 WANs. Simultaneously, combined with an encrypted tunneling protocol (such as WireGuard), a secure and highly penetrating encrypted channel is constructed in the public network environment. This process ensures that data packets sent by the attacker with the first Virtual LAN tag can be securely encapsulated and traverse complex intermediate networks, reaching the master control target range without loss.

[0064] Subsequently, based on the second Virtual LAN label, data packets are encapsulated using the Virtual Extended LAN protocol, and a second encrypted tunnel is established from the destination target range to the master control range via an encrypted tunneling protocol. This step focuses on constructing the network path at the target end. The system also employs VXLAN over WireGuard technology to establish the second encrypted tunnel based on the second Virtual LAN label of the destination target range. This ensures that the target's network environment (regardless of whether it has a public IP address or is behind NAT) can be stably extended to the master control range, making the distributed target resources logically appear as if they were directly connected to the local network of the master control range.

[0065] Finally, the first encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the first communication link, and the second encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the second communication link. This step is the key link in realizing the transformation from "tunnel access" to "routing control." The centralized routing cluster is a group of devices that perform core routing calculations within the main control range. By configuring logical sub-interfaces on the router's physical interfaces and mapping the traffic after decapsulation of the encrypted tunnels to these sub-interfaces one-to-one, the system abstracts the underlying encrypted transmission channel into a Layer 3 logical interface that the router can directly operate.

[0066] Furthermore, the second communication link is constructed in a similar manner to the first communication link. The resulting "first communication link" and "second communication link" possess IP address configuration and routing capabilities, providing a standardized network interface for subsequent cross-domain networking.

[0067] Through steps 501 to 504 above, the combined technical solution of "VLAN tagging + VXLAN encapsulation + encrypted transmission + sub-interface mapping" solves the access problem of geographically dispersed sub-sites and heterogeneous network environments (such as NAT blocking) in the federated network range. It uses VXLAN over WireGuard technology to achieve transparent extension of large Layer 2 networks across wide area networks. At the same time, it uses sub-interface mapping to transform physical tunnels into logical links, which not only ensures the confidentiality and integrity of data transmission, but also decouples the access layer and the routing layer, enabling the main control range to manage the network connections of remote sub-sites as flexibly as managing local interfaces.

[0068] Step 402: In the centralized routing cluster of the main control range, construct the first logical interface corresponding to the first communication link and the second logical interface corresponding to the second communication link.

[0069] Step 402 is described in detail below.

[0070] In some embodiments, within the centralized routing cluster of the master control range, a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link are constructed. This step realizes the mapping from Layer 2 tunnel access to Layer 3 routing control. The centralized routing cluster is a set of core devices within the master control range used to perform centralized Layer 3 routing configuration. The specific process of constructing the logical interfaces includes configuring sub-interfaces on the physical ports of the routers and associating these sub-interfaces with the VLAN tags carried by the established tunnels. The first logical interface serves as the entry point for the attacker to access the Layer 3 network of the master control range, while the second logical interface serves as the exit point for data flow to the target. Through this interface mapping mechanism, external tunnel traffic is introduced into the routing processing domain of the master control range.

[0071] Step 403: Based on the network configuration information of the attacker, configure the first primary IP address on the first logical interface, and based on the network configuration information of the target, configure the second primary IP address on the second logical interface.

[0072] Step 403 will be described in detail below.

[0073] Next, based on the attacker's network configuration information, a first primary IP address is configured on the first logical interface, and based on the target's network configuration information, a second primary IP address is configured on the second logical interface. This step aims to provide the necessary network layer address anchors for cross-domain routing and forwarding. The attacker's network configuration information typically includes information about the network segment where the attacker resides. The system selects an unused, free IP address as the first primary IP address. This address is usually designated as the default gateway for the attacker to access the master control target range, thus "absorbing" attack traffic into the master control target range. Similarly, the target's network configuration information involves the target's network segment, and the system selects the corresponding free IP address as the second primary IP address. It is worth noting that the second primary IP address here serves not only as the interface address but also as the translated source address in the subsequent Source Network Address Translation (SNAT) strategy. This is crucial for compatibility with physical targets that cannot be configured with routes.

[0074] The following section will further describe how to configure the first primary IP address on the first logical interface.

[0075] Reference Figure 6 Based on the network configuration information of the attacking end, the first primary IP address is configured on the first logical interface, including the following steps 601 to 602.

[0076] Step 601: Based on the network configuration information of the attacking end, determine the source network segment where the attacking end is located, and select the first unoccupied IP address from the source network segment.

[0077] Step 602: Configure the first IP address as the first primary IP address of the first logical interface, and specify the first primary IP address as the default next-hop address for the attacker to access the master control target.

[0078] Steps 601 to 602 are described in detail below.

[0079] During the routing process, the attacker, as the initiating party and generally the controllable party, needs to select an idle IP address within their own network segment. This idle IP address will be configured in the Pengcheng router as a virtual route. Simultaneously, the attacking machine needs to configure this IP address as the next hop. If the target IP segment to be accessed is known, the route can be configured based on the target IP segment; if the target is unknown, it can be configured as a default route. To address more flexible use cases, such as incrementally configuring the access relationship between the attacking machine and the target, it is recommended to configure it as a default route. According to the longest match rule, if there are no other routes or IP policies, all traffic from the attacking machine will be redirected to its corresponding gateway and forwarded through the Pengcheng router configuration.

[0080] Therefore, firstly, based on the network configuration information of the attacking device, the source network segment where the attacking device is located is determined, and an unused first IP address is selected from the source network segment. This step is the basic preparatory stage for building Layer 3 routing access. The system first parses the network environment parameters of the attacking device to identify its local area network address range, i.e., the "source network segment" (SourceSubnet). Subsequently, to avoid network interruptions caused by IP address conflicts, the system scans the address usage within this network segment and selects a free address that is not currently assigned to any physical device or virtual node as the "first IP address". This process ensures that the gateway address configured subsequently is unique and legitimate in the attacking device's Layer 2 network, providing a prerequisite for establishing a stable Layer 3 communication anchor point.

[0081] Then, the first IP address is configured as the first primary IP address of the first logical interface, and designated as the default next-hop address for the attacker to access the master control range. This step completes the instantiation of the gateway and the routing configuration. Specifically, the system binds the selected idle IP address to the first logical interface corresponding to the master control range router cluster, making it the identifier of that interface in the Layer 3 network, i.e., the "first primary IP address". Simultaneously, this address is established as the essential gateway for attacker traffic entering the master control range. By designating it as the "default next-hop address" (DefaultGateway), the attacker is instructed to send all packets with destination addresses outside the local network segment to this first logical interface. This configuration utilizes the longest match rule to ensure that when the attacker is unaware of the specific target IP or needs to access multiple network segments, its traffic can be automatically and indiscriminately redirected to the routing control domain of the master control range.

[0082] In addition, the configuration process for the second primary IP address on the second logical interface is similar to that for the first primary IP address.

[0083] Through steps 601 to 602 above, the combined strategy of "selecting idle IPs + configuring gateways + default routing" effectively achieves the convergence of attack traffic to the master control target range. By using idle IPs within the source network segment as virtual gateways, it avoids intrusive modifications to the existing network topology of the attacking party and solves the problem of traffic entry addressing in cross-domain networking. At the same time, the default routing mechanism greatly simplifies the configuration complexity of the attacking party, enabling it to adapt to changing attack and defense scenarios without maintaining complex static routing tables. This ensures that cross-domain attack traffic can stably and efficiently enter the master control target range for subsequent centralized routing and forwarding.

[0084] Reference Figure 7 This is a schematic diagram illustrating the connection between an attacker located in a sub-targeting range and the main control range, provided in an embodiment of this application. Figure 7 The image shows the location of the sub-target range ( Figure 7 The detailed topology and configuration logic for establishing a cross-domain network connection between the attacker's device (referred to as "sub-target range S1") and the main control target range are shown. Figure 7 The area on the left represents the internal network environment of sub-range S1, which includes attacker hosts (IPs shown are 192.168.1.1 and 192.168.1.2). These hosts are assumed to be located on the 192.168.1.0 / 24 local area network. The attacker machines access the local "interconnection gateway" via TRUNK mode, and the data packets carry a "vlan x" label identifying this service flow.

[0085] Figure 7The central section showcases the cross-domain transmission channel. Between the interconnection access gateway of sub-range S1 and the "gateway cluster" of the main control range on the right, an encrypted tunnel based on "VXLAN over WireGuard" technology is established across the "Internet." This tunnel encapsulates and transmits data packets from the sub-range at the Layer 2 network layer, with a bridge threshold set to x, ensuring the security and isolation of data during public network transmission.

[0086] Figure 7 The area on the right represents the internal configuration of the main control range. When a data packet arrives at the gateway cluster, the system maps the tunnel traffic of the sub-range to the unused "vlan x'" within the main control range and forwards it to the "routing configuration" module (i.e., the router cluster) via a physical link. A sub-interface (shown as "subif") is configured on the router. This sub-interface supports vlan x' and its primary IP address is "192.168.1.254". The red dashed arrow at the bottom of the diagram (labeled "nexthop") vividly illustrates the logical routing relationship: although physically it crosses a wide area network, logically, the attacker's host in the sub-range uses this sub-interface IP (192.168.1.254) on the main control range router as its default next-hop address, thus successfully accessing the Layer 3 network environment of the main control range.

[0087] Reference Figure 8 This is a schematic diagram of an attacker configuration located in the main target range, provided in an embodiment of this application. Figure 8 The diagram illustrates the network topology and configuration when the attacker is located inside the main control range (Hub). Unlike remote attackers located in sub-ranges, the attacker in this scenario is deployed directly on the main control range, thus eliminating the need to establish a VXLAN over WireGuard tunnel across the internet; instead, they connect directly through the internal network.

[0088] Figure 8 The document demonstrates the configuration logic of an interconnect access gateway (main control range side) as a Layer 2 traffic aggregation point. An attacker's machine accesses this gateway via VLAN x, and the gateway is configured with a corresponding sub-interface to receive and forward packets carrying VLAN tag x. To achieve more flexible management and maintain consistency with the configuration logic of remote sub-ranges, Figure 8 The document demonstrates a VLAN mapping mechanism: the master control range allocates an unused internal VLAN x' as a mapping, and the gateway achieves transparent interconnection and isolation control of Layer 2 traffic by configuring the VLAN x sub-interface and the VLAN x' sub-interface under the same bridge domain x.

[0089] Figure 8The document also demonstrates the configuration of a router cluster as a Layer 3 gateway. In the router cluster of the main control range, routers selected according to the policy are configured with sub-interfaces supporting VLAN x' on their physical interfaces, and the idle IP address provided by the attacker (…) Figure 8 The IP address (192.168.1.254) is configured as the primary IP address for this sub-interface. Through this "VLAN mapping + Layer 3 gateway" configuration, attacker traffic is successfully routed to the routing layer, completing the construction of the communication network.

[0090] The network structure between the target and the main control range is also location-dependent, and is essentially the same as the network structure between the attacker and the main control range. If located in a sub-range, a connection needs to be established with the main control range; if located in the main control range, a TRUNK mode connection is established via the internal network.

[0091] During the routing process, the target, as the receiving party, is generally uncontrollable, and network changes are typically not made after the scenarios are built in each sub-target area. The internal network of a pre-built target is complete, with its own default routes. However, in some physical scenarios such as automotive, industrial manufacturing, and power generation, there are situations where routing cannot be configured. Therefore, a free IP address within an entry network segment is also required. However, this free IP address functions differently from the attacker's; it is configured in the router as the translated IP address in SNAT (Source Network Address Translation) to translate cross-network segment requests to requests within the same network segment.

[0092] Reference Figure 9 This is a schematic diagram illustrating the connection between a target located in a sub-targeting range and the main control range, provided in an embodiment of this application. Figure 9 The diagram shows the detailed topology and configuration logic for establishing a cross-domain network connection between the target device located in the sub-range (shown as "sub-range S1") and the main control range. It particularly demonstrates the access scheme for physical targets with non-configurable routes. Figure 9 The left side represents the internal network environment of sub-range S1, which includes the target host. Its local area network segment is assumed to be 10.1.1.0 / 24. The target machine connects to the local "interconnection access gateway" via TRUNK mode, and the data packets carry a "vlan y" tag identifying the service flow. The sub-range gateway is configured with corresponding sub-interfaces and bridge thresholds, ready to send data through the tunnel.

[0093] Figure 9The middle section illustrates the cross-domain transmission channel. An encrypted tunnel based on "VXLAN over WireGuard" technology is established across the "Internet" between the interconnection access gateway of sub-range S1 and the "gateway cluster" of the main control range. The tunnel bridge threshold is set to 'y', consistent with the sub-range side, achieving cross-domain extension of the Layer 2 network. When data packets arrive at the main control range, the system maps the traffic to an unused "VLAN y'" within the main control range and forwards it to the core "router cluster" via physical links.

[0094] Figure 9 The right side of the image highlights the special configuration of the main control range router cluster. A sub-interface supporting VLAN 'y' is configured on the selected router physical interface, and an idle IP address within the target network segment (shown as 10.1.1.1 in the diagram) is configured as the primary IP address of this sub-interface. More importantly, this... Figure 9 The demonstration showcases the "SNAT (Source Network Address Translation)" policy deployed on this sub-interface. This policy ensures that the source IP address of all data packets sent from the master control target range to the sub-target target is translated to this idle IP (10.1.1.1). This means that, for the target machine in the sub-target range, the received request appears to originate from a neighbor on the same network segment, and therefore it directly sends the response packet back to this IP (i.e., the interface of the master control router). This successfully achieves cross-domain Layer 3 communication without requiring modifications to the target's own routing configuration.

[0095] Reference Figure 10 This is a schematic diagram of target configuration located in the main target range provided in an embodiment of this application. Figure 10 The diagram illustrates the network topology and configuration logic when the target device is located directly within the main control range (Hub). Unlike remote targets located in sub-ranges, the target in this scenario (referred to as "Target S1") is deployed locally within the main control range. Physically, it does not require establishing a complex encrypted tunnel across the Internet; instead, it connects directly through the internal LAN.

[0096] Figure 10 The first step demonstrates the configuration process for Layer 2 access and VLAN mapping. Target S1 (assuming network segment 10.1.1.0 / 24) accesses the "gateway cluster" through the internal network, with data packets carrying "vlan y". To achieve network isolation and unified management, a VLAN mapping mechanism is configured on the gateway cluster: the system allocates an unused internal "vlan y'" as the mapping and configures the vlan y sub-interface and the vlan y' sub-interface under the same bridge threshold, thereby transparently introducing the target traffic into the internal switching network of the main control target range.

[0097] Figure 10The document further demonstrates the core routing and address translation configurations. In the "Router Configuration" module (i.e., the router cluster), logical sub-interfaces supporting VLAN 'y' are configured on the physical interfaces. Figure 10 The sub-interface is labeled "subif" and an available IP address on the same network segment (address: 10.1.1.1 in the diagram) is configured as the primary IP address for this sub-interface. More importantly, the diagram clearly indicates that the "SNAT (Source Network Address Translation)" policy is enabled on this sub-interface. Figure 10 This is represented as snat:0.0.0.0 / 0 -> 10.1.1.1). This means that regardless of the network segment from which the attack traffic originates, its source IP will be replaced with 10.1.1.1 when forwarded to the target S1 through this interface. This mechanism ensures that the target S1 can correctly send the response packet back to the gateway without modifying its own routing table, thus achieving a Layer 3 network that balances isolation and connectivity in the local environment.

[0098] Step 404: Create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

[0099] Step 404 will be described in detail below.

[0100] In some embodiments, a virtual routing forwarding instance corresponding to the networking request is further created. The first and second logical interfaces are bound to the routing domain of the corresponding virtual routing forwarding instance, and a cross-domain forwarding path from the first logical interface to the second logical interface is established based on the first and second primary IP addresses. This step achieves logical isolation and routing orchestration through Virtual Routing Forwarding (VRF) technology. A virtual routing forwarding instance refers to an independent routing table and forwarding table instance created on a physical router, used to isolate traffic from different tenants or different attack and defense scenarios. The system binds the aforementioned logical interfaces to the corresponding VRF and generates routing table entries to guide traffic from the first logical interface to the second logical interface. Simultaneously, a source network address translation policy is configured based on the second primary IP address, replacing the source IP of data packets sent through the second logical interface with the second primary IP address, thereby constructing a one-way masquerading access path. This method ensures that even if the target end does not configure a return route, the response packet can be correctly returned to the second primary IP address in the same network segment, thus completing cross-domain communication.

[0101] Reference Figure 11 This is a schematic diagram of an access relationship provided in an embodiment of this application. For example... Figure 11The diagram shows four common cross-domain attack and defense access relationship topologies in a federated network range, clearly depicting the different dimensions of logical connection between the attacker (initiator) and the target (receiver). Figure 11 The top left corner shows a "one-to-one access" scenario, i.e., a single attacker node ( Figure 11 (As shown by attacker A) interacts with only one target node within a specific time period. Figure 11 A one-way connection is established with target S1, and the target is in an exclusive state during this period, only accepting access requests from this single attacker.

[0102] Figure 11 The bottom left corner shows a "one-to-many access" scenario, depicting a single attacker ( Figure 11 As shown by attacker A, simultaneously targeting multiple different target nodes ( Figure 11 The topology is shown as follows: targets S1, S2, and S3 initiate access connections. In this scenario, although the attack source is single, its attack surface covers multiple targets, which are controlled or accessed by the attacker during the current time period.

[0103] Figure 11 The top right corner shows a "many-to-one access" scenario, characterized by multiple attacker nodes ( Figure 11 Attackers A1, A2, and A3 converge to access the same target node. Figure 11 This is illustrated as the case of target S1. This corresponds to concurrent attack or joint exercise scenarios, where the system needs to support the simultaneous injection of traffic from multiple sources into a single target, typically involving complex routing isolation and IP conflict handling mechanisms.

[0104] Figure 11 The bottom right corner shows the most complex "many-to-many complex access" scenario, which is a combination of the three basic forms mentioned above. Figure 11 The diagram shows an interleaved connection relationship where attacker A1 simultaneously accesses targets S1 and S2, while attackers A2 and A3 access targets S3 and S2 respectively. This topology includes both point-to-multipoint access and multipoint-to-point concurrency, demonstrating the flexible networking capabilities required by the federated network range to simulate large-scale, highly complex real-world attack and defense exercises.

[0105] Based on this, the detailed creation process and application flow of virtual route forwarding instances under different conditions are described as follows.

[0106] Reference Figure 12 Create a virtual route forwarding instance corresponding to the network request, and bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance, including the following steps 1201 to 1203.

[0107] Step 1201: When the access relationship in the attack and defense network request indicates that a single attacking end is accessing a single target end, create a virtual routing forwarding instance that is isolated from the access relationship.

[0108] Step 1202: Associate the first logical interface and the second logical interface with the routing table of the virtual route forwarding instance to establish a logical connection between the first logical interface and the second logical interface within the same routing domain.

[0109] Step 1203: Generate an access control list based on the source IP network segment of the attacking end, and send the access control list to the second logical interface so that the second logical interface can perform source address validity verification on the data traffic entering the second logical interface based on the cross-domain forwarding path.

[0110] Steps 1201 to 1203 are described in detail below.

[0111] In some embodiments, when the access relationship in the attack-defense network request indicates that a single attacker is accessing a single target, a virtual routing forwarding instance (VRF) isolated from the access relationship is created. This step is mainly for "one-to-one" attack-defense exercise scenarios, where a target is only allowed to be accessed by a specific single attacker within a specific time period. To ensure this exclusive access and the purity of the network environment, the system initializes a new, independent VRF in the router cluster of the main control range. A virtual routing forwarding instance is a technique that simulates multiple independent routing tables within a physical router. Each instance has an independent routing domain and does not interfere with each other. By creating an isolated VRF, it is equivalent to opening a logical "independent sandbox" for this attack-defense confrontation, ensuring that the traffic of this exercise will not be leaked to other scenarios or interfered with by other unauthorized traffic.

[0112] Then, the first and second logical interfaces are associated with the routing table of the virtual routing forwarding instance to establish a logical connection between them within the same routing domain. This step is crucial for mapping physical access to a specific logical routing domain. Specifically, the system binds both the first logical interface representing the attacker and the second logical interface representing the target to the same created VRF instance. In routing technology, interfaces within the same VRF belong to the same routing domain by default, enabling them to learn routing information from each other and forward data. Through this association operation, the Layer 2 link barrier between the attacker and the target is logically broken down, making them appear as if connected to the same dedicated logical router, laying the foundation for subsequent packet forwarding.

[0113] Subsequently, an Access Control List (ACL) is generated based on the attacker's source IP network segment and sent to the second logical interface. This allows the second logical interface to verify the source address legitimacy of incoming data traffic based on the cross-domain forwarding path. Although VRF provides routing-level isolation, to further enhance security and prevent potential misoperations or address spoofing within the same VRF, the system introduces an Access Control List (ACL) mechanism. The system generates filtering rules based on the attacker's legitimate source IP address range and applies these rules to the inbound or outbound directions of the target's corresponding second logical interface. This means that only packets with source IPs matching the ACL rule are allowed to enter the target network through the second logical interface; any abnormal traffic with mismatched source addresses will be dropped, thus achieving fine-grained source address legitimacy verification.

[0114] Reference Figure 13 This is a schematic diagram illustrating the construction of a one-to-one access relationship network provided in an embodiment of this application. For example... Figure 13 The diagram clearly shows the process by which an attacker (“Attacker A” on the left, network segment 192.168.1.0 / 24) and a target (“Target S” on the right, network segment 10.1.1.0 / 24) establish a controlled communication link through the “gateway cluster” and “routing function (router cluster)” of the master control range.

[0115] Figure 13 The rectangle at the bottom center highlights the router's internal logical configuration. To achieve one-to-one isolated access, the system creates a dedicated virtual route forwarding instance "vrf r1" ( Figure 13 (As shown in the yellow ellipse). The logical sub-interface "sub A" (configured with IP 192.168.1.254) on the attacker's side and the logical sub-interface "sub S" (configured with IP 10.1.1.1) on the target's side are both bound to "vrf r1". This binding relationship logically constructs a closed routing domain, ensuring that the traffic of this attack and defense confrontation will not be leaked to other routing instances.

[0116] also, Figure 13 The red dashed line path from "sub A" to "sub S" clearly marks an "ACL" (Access Control List). This corresponds to a key security policy in the configuration: based on the interconnectedness of the same VRF, ACL rules are used for finer-grained filtering, allowing only traffic originating from the attacker's A network segment (192.168.1.0 / 24) to enter the target network through "sub S," thus adding an identity verification barrier in addition to logical isolation. Meanwhile, Figure 13The "sub S" section also shows the SNAT configuration (0.0.0.0 / 0 -> 10.1.1.1), which ensures that the return packet path for cross-network segment access is unobstructed.

[0117] Through steps 1201 to 1203 above, a highly secure dedicated channel is constructed for one-to-one attack and defense scenarios using a combined strategy of "VRF isolation + same-domain binding + ACL verification." VRF technology ensures complete isolation of routing tables between different attack and defense tasks, avoiding routing conflicts and traffic crosstalk. Meanwhile, ACL-based source address verification adds a mandatory authentication barrier on top of route reachability, strictly limiting the target's access range. This dual isolation mechanism not only meets the stringent requirements of the test range for environmental purity but also provides an interference-free network environment for accurately assessing the attack effectiveness of a single attacker.

[0118] Reference Figure 14 Create a virtual route forwarding instance corresponding to the network topology request, and bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance, including the following steps 1401 to 1403.

[0119] Step 1401: When the access relationship in the attack and defense network request indicates that multiple attack terminals access the same target terminal at the same time, create a corresponding independent attack terminal virtual routing forwarding instance for each attack terminal, and create an independent target terminal virtual routing forwarding instance for the target terminal. The virtual routing forwarding instance includes multiple attack terminal virtual routing forwarding instances and target terminal virtual routing forwarding instances.

[0120] Step 1402: Associate the first logical interface corresponding to each attacker with the corresponding virtual routing forwarding instance of the attacker, and associate the second logical interface with the virtual routing forwarding instance of the target.

[0121] Step 1403: Generate a destination network address translation rule in each attacker's virtual routing forwarding instance. The destination network address translation rule is used to direct the next hop of the data traffic to the target's virtual routing forwarding instance while keeping the destination IP address of the data traffic unchanged.

[0122] Steps 1401 to 1403 are described in detail below.

[0123] When the access relationship in the attack-defense network request indicates that multiple attackers simultaneously access the same target, a corresponding independent virtual routing forwarding instance is created for each attacker, and a separate target virtual routing forwarding instance is created for the target. The virtual routing forwarding instances include multiple attacker virtual routing forwarding instances and target virtual routing forwarding instances. This step targets "many-to-one" concurrent attack scenarios (such as DDoS simulations or multi-team joint exercises), where multiple attackers may use the same private IP address. To avoid routing conflicts and achieve fine-grained control, the system employs Virtual Routing Forwarding (VRF) technology. On the physical router, an independent logical routing table (i.e., attacker virtual routing forwarding instance) is created for each attacker, and a separate routing table (i.e., target virtual routing forwarding instance) is also created for the attacked target. This fully isolated strategy is equivalent to building a parallel network space for each participant, ensuring that even if different attackers have the same IP address, no address conflict will occur at the routing level of the master control range.

[0124] Then, the first logical interface corresponding to each attacker is associated with its corresponding attacker virtual routing forwarding instance, and the second logical interface is associated with the target virtual routing forwarding instance. This step achieves interface-level isolation mapping. Specifically, the system binds the first logical interface connecting different attackers to the attacker's VRF created separately for them, while binding the second logical interface connecting the target to the target's VRF. Through this association, traffic entering the master router is strictly restricted to table lookup forwarding within their respective virtual routing domains. At this point, the attacker's traffic cannot reach the target because they are in completely isolated routing domains, which provides the infrastructure for establishing unidirectional connections on demand later.

[0125] Next, a destination network address translation (DNAT) rule is generated in each attacker's virtual routing forwarding instance. This DNAT rule directs the next hop of data traffic to the target's virtual routing forwarding instance while keeping the destination IP address unchanged. This step is crucial for breaking VRF isolation and establishing a cross-domain attack path. Although conventional DNAT is typically used to modify the destination IP, in this embodiment, the rule is used as a special policy routing technique (Route Leaking). Its core function is to forcibly modify the next hop of the route without changing the destination IP address of the data packet, thus "directing" or "leaking" the data flow from the attacker's virtual routing domain to the target's virtual routing domain. This is equivalent to building a one-way bridge between two isolated virtual networks, allowing attack traffic to cross the VRF boundary and reach the target while maintaining the independence of the routing table.

[0126] Reference Figure 15This is a schematic diagram illustrating the construction of a many-to-one access relationship network provided in an embodiment of this application. Figure 15 The diagram illustrates how to support multiple attackers ( Figure 15 The attackers, designated "Attacker A1" and "Attacker A2," simultaneously accessed the same target despite having the same IP address (both 192.168.1.0 / 24). Figure 15 It is shown as "target S", network segment 10.1.1.0 / 24. Figure 15 The left side of the screen shows that attackers A1 and A2 have configured the same default route (gw: 192.168.1.254) and access the master control range through the gateway cluster.

[0127] Figure 15 The "Routing Function (Router Cluster)" box at the bottom center details the core mechanism for resolving IP conflicts—VRF isolation. The system creates an independent virtual routing instance for each attacker: the sub-interface "sub 10" corresponding to attacker A1 is bound to "vrf 10" (red path), while the sub-interface "sub 11" corresponding to attacker A2 is bound to "vrf11" (purple path). Simultaneously, the sub-interface "sub 20" corresponding to target S is bound to a separate "vrf 20" (blue path). This configuration ensures that even if the attackers have the same source IP, their data flows operate in completely isolated virtual routing tables, without interference.

[0128] Figure 15 The diagram further illustrates the connectivity logic across VRFs. The red arrow pointing from "vrf 10" to "vrf 20" and the purple arrow pointing from "vrf 11" to "vrf 20" are both labeled "DNAT: 10.1.1.0 / 24 -> 10.1.1.0 / 24". This indicates that by configuring destination network address translation rules (as policy routing), the next hop of traffic is forced from the attacker's VRF to the target's VRF without changing the destination IP address of the data packets, thus establishing a unidirectional connection. Furthermore, the target-side sub-interface "sub 20" also shows an "ACL" configuration to restrict legitimate source network segments and an "SNAT" configuration (0.0.0.0 / 0 -> 10.1.1.1) to ensure that return packets are correctly returned to the gateway.

[0129] Through steps 1401 to 1403 above, the combined mechanism of "independent VRF isolation + cross-domain DNAT routing" solves the problem of IP address conflicts in complex "many-to-one" attack and defense scenarios in federated network ranges. By creating an independent routing instance for each attacker, the system can tolerate attackers using duplicate IP addresses, greatly reducing the constraints on network planning for each sub-range. At the same time, by using special DNAT rules to achieve unidirectional connectivity across VRFs, not only is precise traffic aggregation achieved, but the target network's invisibility to the attack source is also ensured (unless reverse routing is configured), thus flexibly supporting the needs of high-level exercises such as large-scale concurrent attacks and red-blue team exercises.

[0130] The above describes the network construction of common targets. The networking method for the federated network range provided in this application also supports some special scenarios. (Refer to...) Figure 16 This is a schematic diagram of the internal network of a target provided in an embodiment of this application. Figure 16 The diagram illustrates attack and defense access scenarios corresponding to three typical target internal network topologies in a federated network range. Figure 16 The top left corner shows the "single network segment target" structure, in which the servers inside the target (such as IP 10.1.1.10 and 10.1.1.12) are connected in the same local area network through a switch. Attackers can only directly access machines in this single entry network segment. If they need to access other network segments, they need to move laterally through a jumper. Figure 16 The bottom left corner shows the "multi-segment target" structure, which connects two different local area network segments (10.1.1.0 / 24 and 172.10.1.0 / 24 as shown in the figure) through an internal router. Attackers are allowed to directly access multiple network segments inside the target. Figure 16 The right side of the image shows a special "routing and forwarding scenario". In this scenario, the target network is connected to the Internet through a router. Its main function is not to provide regular services, but to route and forward the attacker's traffic to the Internet. This is usually used for honeypot systems or for the trapping and collection of attack and defense data.

[0131] Reference Figure 17 Create a virtual route forwarding instance corresponding to the network topology request, and bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance, including the following steps 1701 to 1704.

[0132] Step 1701: When the access relationship in the attack and defense network request indicates that the attacking end accesses multiple target ends with conflicting IP addresses at the same time, create a target virtual route forwarding instance corresponding to each target end.

[0133] Step 1702: Bind the second logical interface corresponding to each target end to the corresponding target virtual routing forwarding instance.

[0134] Step 1703: Assign a corresponding virtual destination IP address to each target.

[0135] Step 1704: Generate destination network address translation rules and send the destination network address translation rules to the attack virtual routing forwarding instance associated with the attacking end, so that the attack virtual routing forwarding instance will convert access requests for virtual destination IP addresses into access requests for real IP addresses of conflicting target ends, and direct data traffic to the corresponding target virtual routing forwarding instance. The virtual routing forwarding instance includes multiple target virtual routing forwarding instances and attack virtual routing forwarding instances.

[0136] Steps 1701 to 1704 are described in detail below.

[0137] In some embodiments, when the access relationship in the attack-defense network request indicates that the attacking end simultaneously accesses multiple target endpoints with conflicting IP addresses, a target virtual routing forwarding instance is created for each target endpoint. This step specifically addresses the common problem of overlapping IP addresses of multiple targets in federated network ranges (e.g., multiple physical targets all having the same default IP address of 192.178.1.100). In conventional networks, routers cannot distinguish between multiple destinations with the same IP address. Therefore, the system utilizes the isolation characteristics of Virtual Routing Forwarding (VRF) technology to create an independent routing table, i.e., a "target virtual routing forwarding instance," for each target endpoint with IP conflicts. In this way, the system logically divides conflicting targets into different parallel network spaces, making them unique within their respective routing domains, thus laying the isolation foundation for subsequent resolution of address conflicts.

[0138] Next, the second logical interface corresponding to each target is bound to the corresponding target virtual routing forwarding instance. This step completes the mapping of physical connections to logical isolation domains. Specifically, the system associates the second logical interface connecting each target (i.e., the interface connecting the target on the master control range side) with a target VRF specifically created for that target. This operation ensures that traffic from or to a specific target is strictly restricted to its own virtual routing instance for processing, preventing route oscillation or traffic misforwarding caused by identical IP addresses, and achieving complete decoupling of conflicting targets at the Layer 2 and Layer 3 network layers.

[0139] Next, a corresponding virtual destination IP address is assigned to each target. Since the real IPs of conflicting targets cannot coexist in the same routing table on the attacker's end, the system needs to assign each target a unique and non-conflicting IP address from the attacker's perspective, i.e., a "virtual destination IP." For example, for two targets with the same real IP of 192.178.1.100, the system can assign 10.1.1.1 and 10.1.1.2 as their virtual counterparts, respectively. The attacker will subsequently distinguish and connect to different targets by accessing these unique virtual IPs, thus masking the complexity of underlying real IP conflicts.

[0140] Finally, destination network address translation (DNAT) rules are generated and sent to the attack virtual routing forwarding instance associated with the attacker. This causes the attack virtual routing forwarding instance to translate access requests targeting virtual destination IP addresses into access requests targeting the real IP address of the conflicting target, and to redirect data traffic to the corresponding target virtual routing forwarding instance. The virtual routing forwarding instance includes multiple target virtual routing forwarding instances and attack virtual routing forwarding instances. This step is the core logic for achieving "cross-domain mapping access." The system configures a special DNAT policy in the attacker's VRF. This policy has two functions: first, "address translation," which translates packets sent by the attacker with a destination address of a virtual IP address into the target's real IP address; second, "routing redirection," which modifies the next hop of the route during the translation, "leaking" or forwarding the data flow from the attacker's VRF to the corresponding target VRF. This allows attack traffic to accurately traverse VRF isolation boundaries and reach the specified target without requiring either the attacker or the target to modify any of their network configurations.

[0141] Reference Figure 18 This is a schematic diagram of a target IP conflict provided in an embodiment of this application. Figure 18 The diagram illustrates a logical networking and configuration scheme for resolving "multi-target IP address conflicts" in a federal network range. Figure 18 The scenario is set up so that attacker A (left) needs to simultaneously access two targets, S1 and S2, which have the same network segment IP (both 10.1.1.0 / 24). To resolve the conflict without modifying the original network configuration of the targets, the router cluster in the master control range (bottom box) adopts a differentiated routing strategy: for target S1, its original configuration is retained, and its interface (sub S1) and the attacker's interface (sub A) are placed in the same or interconnected virtual routing environment (…). Figure 18(shown as green path); For the conflicting target S2, the system creates an independent isolated virtual route instance "vrf r2" and binds the interface (sub S2) of S2 to it. The core configuration in the diagram lies in the DNAT rule in "vrf r1" ( Figure 18 The highlighted section in yellow: DNAT: 10.1.2.0 / 24 -> 10.1.1.0 / 24), this rule allocates a virtual external network segment (10.1.2.0 / 24) to S2. When an attacker accesses this virtual network segment, DNAT not only translates the destination IP to S2's real IP, but also forcibly redirects the data flow from "vrf r1" to the isolated "vrf r2". Figure 18 The two red dashed lines in the diagram clearly depict this dual-track access path: one is the regular path for direct access to S1, and the other is a special path for accessing S2 through address translation and cross-VRF hopping, thus enabling concurrent access in the event of IP conflicts.

[0142] Through steps 1701 to 1704 above, the combined mechanism of "VRF isolation + virtual IP mapping + cross-domain DNAT" solves the extremely difficult problem of multi-target IP address conflicts in federated network ranges. The solution proposed in this application, without changing the original network configuration of the targets (which is especially important for physical targets such as industrial control systems), achieves the reuse and differentiation of overlapping IP address spaces by introducing a virtual IP layer and isolated routing instances on the main control range side. This not only significantly reduces the coordination cost of sub-range network planning, but also gives attackers the ability to conduct concurrent attacks and comparative tests on multiple targets with the same IP within the same time period, greatly enhancing the range's support level for complex combat scenarios.

[0143] Reference Figure 19 This is a schematic diagram of multi-segment target access provided in an embodiment of this application. For example... Figure 19 The diagram shown illustrates the network topology and routing configuration for a "multi-segment target" access scenario. Figure 19 The "target S1" on the right is constructed as a multi-layered network structure containing routers, including both the entry network segment (10.1.1.0 / 24) and the internal deep network segment (172.10.1.0 / 24). To enable "Attacker A" on the left to directly access all network segments within the target, the router cluster in the master control range ( Figure 19 The box at the bottom center shows that a critical configuration extension was executed in the attacker-associated "virtual route vrf r1": not only were DNAT rules added for the 172.10.1.0 / 24 network segment, but a static route was also specifically added. Figure 19As shown in red text at the bottom, this clearly indicates that all data packets destined for the 172.10.1.0 / 24 network segment will have their next-hop address pointing to the router IP (10.1.1.254) at the target S1 ingress point. This combination of "DNAT rules + static route guidance" ensures that attack traffic can traverse the target's boundary routers and accurately reach deep network nodes within the target.

[0144] Reference Figure 20 This is a schematic diagram of a routing and forwarding scenario provided in an embodiment of this application. For example... Figure 20 The image shows a special “routing and forwarding scenario” network topology in a federal network range, which is mainly used to record attack and defense traffic through targets. Figure 20 The left side represents attacker A, and the right side represents target S1 connected to the internet. To address the situation where the destination IP address is not fixed when accessing the internet, the router cluster in the master control range (…) Figure 20 The box at the bottom center no longer uses DNAT, but instead adopts a route sharing mechanism. Figure 20 (This is shown as route replicate). The diagram shows that the "virtual route vrfr2" associated with target S1 is configured with a default route (route: 0.0.0.0 -> nexthop: 10.1.1.254), indicating that the next hop for all unknown traffic is a router interface within target S1. Through route replication, this routing policy is shared with the "virtual route vrf r1" associated with the attacker. Therefore, when attacker A sends a data packet to access the internet and it arrives at "vrf r1", it will be forcibly redirected to target S1 according to the shared default route. The traffic is then recorded within the target's internal network before being forwarded to the internet, thus achieving full auditing and data collection of the attack.

[0145] Reference Figure 21 The process of establishing a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address includes the following steps 2101 to 2102.

[0146] Step 2101: Generate a routing table entry in the virtual routing forwarding instance. The routing table entry indicates that packets with the source address of the first primary IP address should be directed to the link with the second logical interface as the next hop.

[0147] Step 2102: Apply the source network address translation strategy on the second logical interface to use the second primary IP address as the translated source address to perform address replacement processing on the data packets that are directed to the second logical interface via the routing table entry, so as to obtain the cross-domain forwarding path from the first logical interface to the target end.

[0148] Steps 2101 to 2102 are described in detail below.

[0149] In some embodiments, routing entries are generated in the Virtual Router Forwarding Instance (VRF) that direct packets with a source address of the first primary IP address to a link with a second logical interface as the next hop. This step belongs to the "route guidance" phase of cross-domain forwarding path construction. Within the isolated domain of the VRF, the system needs to define the forwarding direction of packets. By generating specific routing entries, the router cluster is instructed on how to handle traffic from the attacker (identified by the first primary IP address). This routing entry acts as a navigation instruction, forcing packets matching a specific source address to have their next hop directed to the egress link connecting to the target, i.e., the link containing the second logical interface. This ensures that attack traffic does not get lost in the complex virtual routing network but is precisely pushed to the logical egress leading to the target.

[0150] Then, a source network address translation (SNAT) strategy is applied on the second logical interface to use the second primary IP address as the translated source address. This performs address substitution processing on packets destined for the second logical interface via routing table entries, resulting in a cross-domain forwarding path from the first logical interface to the target. This step belongs to the "address masquerading" stage of path construction. When a packet is about to leave the master control range and enter the target network, the system performs source network address translation (SNAT) at the egress point (second logical interface). Specifically, the system replaces the source IP address in the packet header with the second primary IP address. Since the second primary IP address is usually an idle IP address in the same network segment as the target, this substitution makes the target mistakenly believe that the request comes from a neighbor in its local network segment. Therefore, without modifying the target's original routing configuration, this ensures that the target can correctly send the response packet back to the second logical interface, completing the logical one-way masquerading access path construction.

[0151] Through steps 2101 and 2102 above, the technical pain point of "unreachable backhaul routes" in cross-domain networking is solved by combining the mechanism of "precise route guidance + source address masquerading". By generating routing table entries within the VRF, it is ensured that attack traffic can accurately reach the exit point across logical isolation domains; and by applying the Source Network Address Translation (SNAT) strategy, cross-domain access from heterogeneous networks is disguised as local access within the same network segment. This is particularly crucial for physical targets such as industrial control equipment and automotive electronics that cannot be configured with gateways or routing tables, effectively achieving cross-domain network interconnection under the premise of zero intrusion.

[0152] By employing the networking methods provided in steps 401 to 404 above, and building a centralized routing cluster in the main control range using a "three-segment" configuration approach, the technical challenges of high configuration coupling and lack of support for cross-network segment access in existing large Layer 2 interconnection schemes are solved. First, through the isolation and orchestration of VRF instances, concurrent access and time-sharing control in scenarios with multiple target IP address conflicts are achieved, significantly improving networking flexibility. Second, by utilizing the Source Network Address Translation (SNAT) mechanism based on the second primary IP address to establish cross-domain forwarding paths, the problem of physical targets such as automotive and industrial control systems being unable to access the range due to the inability to modify their internal routing configurations is successfully solved. Finally, this method decouples physical access from logical routing, allowing each sub-range to remain unaware of complex end-to-end topologies and only need to maintain a connection with the main control range, greatly reducing the operational complexity and deployment costs of the distributed federated range.

[0153] Reference Figure 22 This is a schematic diagram of the networking process of a federal network range provided in an embodiment of this application. Figure 22 The diagram shows the overall configuration of a complex three-layer network construction scheme that supports cross-domain multi-target attacks and offensive-defensive confrontation. Figure 22 The macroscopic view presents a star-shaped distributed architecture with the "master range" as the center (Hub) and multiple sub-ranges (such as "sub-range A", "sub-range S1", and "sub-range S2") located in different regions connected by the "Internet". Figure 22 The yellow dashed arrows represent "encrypted communication" links, indicating that a secure tunnel connection (such as VxLAN over WireGuard) has been established between the "interconnection access gateway devices" of each sub-range and the "interconnection access gateway device cluster" of the main control range, realizing cross-domain interconnection of the underlying physical network.

[0154] Figure 22 The diagram uses green dashed arrows (labeled 1, 2, and 3) to depict a typical "cross-network segment access path example," vividly demonstrating the core process of Layer 3 routing and forwarding. First, an attacker located in sub-field A (IP network segment 192.168.1.x / 24) initiates an attack request (path 1). The traffic is encapsulated by the local gateway and travels across the internet to the main control field. Second, the gateway cluster in the main control field redirects the traffic through the "internal network" to the core "router cluster" (path 2), where Layer 3 forwarding decisions are made based on predefined VRF and routing policies. Finally, the processed traffic is encapsulated again by the gateway cluster and forwarded to the destination sub-field S1 (IP network segment 192.168.2.x / 24) (path 3). This process clearly demonstrates how different network segments (192.168.1.x accessing 192.168.2.x) achieve interoperability through a centralized routing cluster.

[0155] In addition, Figure 22 This also visually demonstrates the application of the "three-stage configuration" concept proposed in this invention in complex scenarios. The diagram shows various types of target range access (such as attacker target range A, target ranges S1 and S2), each accessing the local gateway via TRUNK mode, maintaining the independence of the access method. The router cluster of the main control range acts as the logical control hub, decoupling the underlying tunnel connection from the upper-layer attack and defense access relationship. This allows the system to flexibly support complex attack and defense networking requirements such as one-to-one, many-to-one, and cross-network segments without changing the internal network architecture of each sub-target range.

[0156] Reference Figure 23 This is a schematic diagram illustrating a three-layer network construction scheme supporting cross-domain multi-target attacks and offensive-defensive confrontation, provided in an embodiment of this application. For example... Figure 23 As shown, with the "master range" as the core hub, the distributed networking architecture containing multiple heterogeneous sub-ranges (sub-ranges A, S1, S2, S3) is described in detail, as well as the complex attack and defense logic implemented in the router cluster through various routing strategies (VRF, SNAT, DNAT, route replication).

[0157] Figure 23 The upper-middle section represents the internal architecture of the "main control test range," divided into a "gateway port reverse mapping" layer and a "layer 3 routing configuration" layer. Internet gateway devices (M1, M2, M3) receive encrypted tunnel traffic (e.g., WireGuard ports 9090-9093, VXLAN IDs 5100-5301) from different sub-test ranges via public network interfaces (e.g., eth2), and decapsulate it before mapping it to internal VLANs (e.g., VLANs 11, 12, 100, 200, etc.). This design achieves standardized aggregation at the physical access layer.

[0158] Figure 23The dashed box in the lower middle section highlights the logical orchestration within the "router cluster," which is the core of implementing complex attack and defense scenarios. The diagram illustrates multiple isolated or interconnected virtual routing forwarding instances (such as VRF 11, VRF 12, VRF 300, and VRF 100): Attack source aggregation: Traffic from attacker groups 1 and 2 is aggregated into "VRF 11"; Many-to-one and IP conflict handling: Through the "DNAT (Destination IP Translation)" strategy, traffic in VRF 12 is directed to VRF 300, achieving controlled redirection of attack traffic across VRFs and resolving the need for multiple target IP conflicts or hiding the real target IP; Route replication: Through the "route replicate" mechanism, routing information from VRF 100 is shared with VRF 11, supporting special routing forwarding or traffic auditing scenarios; Physical target compatibility: The "SNAT" strategy is widely applied on the sub-interfaces connecting to the targets (such as sub 200 and sub 300) to ensure that return traffic from cross-domain access can be returned correctly.

[0159] also, Figure 23 Different attack and defense service flows are distinguished by different colored lines (green, orange, red, blue, etc.), which intuitively demonstrates shared targets (such as target S11 being shared by multiple groups), exclusive targets (such as target S32 being accessed only by a specific group), and complex cross-network segment access paths. This fully demonstrates the technical advantage of the proposed solution in flexibly constructing diverse attack and defense scenarios through software definition under a unified physical architecture.

[0160] This application also provides a networking device for a federal network range, which can implement the above-mentioned networking method for a federal network range, referring to... Figure 24 The device 2400 includes: The link building module 2410 is used to respond to the attack and defense networking request, establish a first communication link between the source target range where the attacking end is located and the main control target range, and establish a second communication link between the destination target range where the target end is located and the main control target range. The interface configuration module 2420 is used to construct a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link in the centralized routing cluster of the main control range. Address configuration module 2430 is used to configure a first primary IP address on a first logical interface based on the network configuration information of the attacking end, and to configure a second primary IP address on a second logical interface based on the network configuration information of the target end. The routing orchestration module 2440 is used to create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

[0161] In some embodiments, the routing orchestration module 2440 is further configured to: In the virtual routing forwarding instance, a routing table entry is generated, which indicates that a packet with the source address of the first primary IP address should be directed to the link with the second logical interface as the next hop. A source network address translation strategy is applied on the second logical interface to use the second primary IP address as the translated source address. This allows for address replacement processing of data packets directed to the second logical interface via routing table entries, thus obtaining a cross-domain forwarding path from the first logical interface to the target.

[0162] In some embodiments, the link construction module 2410 is further configured to: Obtain the first virtual local area network (VLAN) tag configured on the interconnection access gateway of the source target range, and obtain the second virtual local area network (VLAN) tag configured on the interconnection access gateway of the destination target range; Based on the first virtual LAN label, data packets are encapsulated using the virtual extended LAN protocol, and a first encrypted tunnel is established from the source target range to the master control target range through the encrypted tunnel protocol. Based on the second virtual LAN label, data packets are encapsulated using the virtual extended LAN protocol, and a second encrypted tunnel is established from the destination target range to the master control target range through the encrypted tunnel protocol. The first encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the first communication link, and the second encrypted tunnel is mapped to a physical port sub-interface of the centralized routing cluster to obtain the second communication link.

[0163] In some embodiments, the address configuration module 2430 is further configured to: Based on the network configuration information of the attacker, determine the source network segment where the attacker is located, and select the first unoccupied IP address from the source network segment; Configure the first IP address as the first primary IP address of the first logical interface, and specify the first primary IP address as the default next-hop address for the attacker to access the master control target range.

[0164] In some embodiments, the routing orchestration module 2440 is further configured to: When the access relationship in the attack and defense network request indicates that a single attacking end accesses a single target end, a virtual routing forwarding instance isolated from the access relationship is created; Associate the first logical interface and the second logical interface with the routing table of the virtual route forwarding instance to establish a logical connection between the first logical interface and the second logical interface within the same routing domain; An access control list is generated based on the source IP network segment of the attacking end, and the access control list is sent to the second logical interface so that the second logical interface can perform source address validity verification on the data traffic entering the second logical interface based on the cross-domain forwarding path.

[0165] In some embodiments, the routing orchestration module 2440 is further configured to: When the access relationship in the attack and defense network request indicates that multiple attacking ends access the same target end at the same time, a corresponding independent attacking end virtual routing forwarding instance is created for each attacking end, and a separate target end virtual routing forwarding instance is created for the target end. The virtual routing forwarding instance includes multiple attacking end virtual routing forwarding instances and target end virtual routing forwarding instances. Associate the first logical interface corresponding to each attacker with the corresponding virtual routing and forwarding instance of the attacker, and associate the second logical interface with the virtual routing and forwarding instance of the target. Destination network address translation rules are generated in each attacker's virtual routing forwarding instance. These rules are used to direct the next hop of data traffic to the target's virtual routing forwarding instance while keeping the destination IP address of the data traffic unchanged.

[0166] In some embodiments, the routing orchestration module 2440 is further configured to: When the access relationship in the attack and defense network request indicates that the attacking end accesses multiple target ends with conflicting IP addresses at the same time, a target virtual route forwarding instance corresponding to each target end is created. Bind the second logical interface corresponding to each target end to the corresponding target virtual route forwarding instance; Assign a corresponding virtual destination IP address to each target. A destination network address translation rule is generated and sent to the attack virtual routing forwarding instance associated with the attacker. This causes the attack virtual routing forwarding instance to translate access requests for virtual destination IP addresses into access requests for the real IP addresses of the conflicting target, and to direct data traffic to the corresponding target virtual routing forwarding instance. The virtual routing forwarding instance includes multiple target virtual routing forwarding instances and attack virtual routing forwarding instances.

[0167] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, the specific implementation of the networking device of the federal network range is basically the same as the specific implementation of the networking method of the federal network range, and will not be repeated here.

[0168] This application also provides an electronic device, including: At least one memory; At least one processor; At least one program; The program is stored in a memory, and the processor executes the at least one program to implement the networking method for the federal network range described above in this application. The electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), in-vehicle computers, etc.

[0169] Please see Figure 25 , Figure 25 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 2501 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 2502 can be implemented in the form of ROM (Read-Only Memory), static storage device, dynamic storage device, or RAM (Random Access Memory). The memory 2502 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 2502 and is called and executed by the processor 2501 to execute the networking method of the federated network range in the embodiments of this application. The 2503 input / output interface is used to implement information input and output. The communication interface 2504 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 2505 transmits information between various components of the device (e.g., processor 2501, memory 2502, input / output interface 2503, and communication interface 2504); The processor 2501, memory 2502, input / output interface 2503 and communication interface 2504 are connected to each other within the device via bus 2505.

[0170] This application also provides a storage medium, which is a computer-readable storage medium, storing a computer program that, when executed by a processor, implements the networking method of the aforementioned federated network range.

[0171] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0172] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0173] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0174] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0175] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0176] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0177] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0178] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, or indirect coupling or communication connection between the apparatus or units, and may be electrical, mechanical, or other forms.

[0179] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0180] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0181] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A networking method for a federated network range, characterized in that, The method includes: In response to the attack and defense networking request, a first communication link is established between the source target range where the attacking end is located and the main control target range, and a second communication link is established between the destination target range where the target end is located and the main control target range. In the centralized routing cluster of the main control range, a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link are respectively constructed. Based on the network configuration information of the attacking end, a first primary IP address is configured on the first logical interface, and based on the network configuration information of the target end, a second primary IP address is configured on the second logical interface. Create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

2. The networking method for the federated network range according to claim 1, characterized in that, The establishment of a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address includes: In the virtual routing forwarding instance, a routing table entry is generated, which indicates that a data packet with the source address of the first primary IP address should be directed to a link with the second logical interface as the next hop. A source network address translation strategy is applied to the second logical interface to use the second primary IP address as the translated source address to perform address replacement processing on data packets directed to the second logical interface via the routing table entry, thereby obtaining the cross-domain forwarding path from the first logical interface to the target end.

3. The networking method for the federated network range according to claim 1, characterized in that, The establishment of a first communication link between the source range where the attacking end is located and the master control range, and the establishment of a second communication link between the destination range where the target end is located and the master control range, include: Obtain the first virtual local area network (VLAN) tag configured on the interconnection access gateway of the source target range, and obtain the second virtual local area network (VLAN) tag configured on the interconnection access gateway of the destination target range; Based on the first virtual LAN tag, data packets are encapsulated using the Virtual Extended LAN protocol, and a first encrypted tunnel from the source target range to the master control target range is established through the encrypted tunnel protocol. Based on the second virtual LAN tag, data packets are encapsulated using the virtual extended LAN protocol, and a second encrypted tunnel is established from the destination target range to the master control target range through the encrypted tunnel protocol. The first encrypted tunnel is mapped to the physical port sub-interface of the centralized routing cluster to obtain the first communication link, and the second encrypted tunnel is mapped to the physical port sub-interface of the centralized routing cluster to obtain the second communication link.

4. The networking method for the federated network range according to claim 1, characterized in that, The configuration of the first primary IP address on the first logical interface based on the network configuration information of the attacking terminal includes: Based on the network configuration information of the attacking terminal, the source network segment where the attacking terminal is located is determined, and an unoccupied first IP address is selected from the source network segment; Configure the first IP address as the first primary IP address of the first logical interface, and specify the first primary IP address as the default next-hop address for the attacker to access the master control target range.

5. The networking method for the federated network range according to claim 1, characterized in that, The step of creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense networking request indicates that a single attacking end accesses a single target end, a virtual routing forwarding instance corresponding to and isolated from the access relationship is created; The first logical interface and the second logical interface are associated with the routing table of the virtual route forwarding instance to establish a logical connection between the first logical interface and the second logical interface within the same routing domain; An access control list is generated based on the source IP network segment of the attacking end, and the access control list is sent to the second logical interface so that the second logical interface can perform source address validity verification on the data traffic entering the second logical interface based on the cross-domain forwarding path.

6. The networking method for the federated network range according to claim 1, characterized in that, The step of creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense network request indicates that multiple attack terminals access the same target terminal at the same time, a corresponding independent attack terminal virtual routing forwarding instance is created for each attack terminal, and an independent target terminal virtual routing forwarding instance is created for the target terminal. The virtual routing forwarding instance includes multiple attack terminal virtual routing forwarding instances and target terminal virtual routing forwarding instances. Associate the first logical interface corresponding to each of the attacking ends with the corresponding virtual routing and forwarding instance of the attacking end, and associate the second logical interface with the virtual routing and forwarding instance of the target end; In each of the attack-side virtual routing forwarding instances, a destination network address translation rule is generated. The destination network address translation rule is used to direct the next hop of the data traffic to the target-side virtual routing forwarding instance while keeping the destination IP address of the data traffic unchanged.

7. The networking method for the federated network range according to claim 1, characterized in that, The step of creating a virtual route forwarding instance corresponding to the network request and binding the first logical interface and the second logical interface to the routing domain of the corresponding virtual route forwarding instance includes: When the access relationship in the attack and defense networking request indicates that the attacking end accesses multiple target ends with conflicting IP addresses at the same time, a target virtual route forwarding instance corresponding to each target end is created; Bind the second logical interface corresponding to each target terminal to the corresponding target virtual routing forwarding instance; Assign a corresponding virtual destination IP address to each of the target terminals; A destination network address translation rule is generated, and the destination network address translation rule is sent to the attack virtual routing forwarding instance associated with the attacking end, so that the attack virtual routing forwarding instance converts the access request for the virtual destination IP address into the access request for the real IP address of the conflicting target end, and directs the data traffic to the corresponding target virtual routing forwarding instance. The virtual routing forwarding instance includes multiple target virtual routing forwarding instances and the attack virtual routing forwarding instance.

8. A networking device for a federal network range, characterized in that, The device includes: The link construction module is used to respond to the attack and defense networking request, establish a first communication link between the source target range where the attacking end is located and the main control target range, and establish a second communication link between the destination target range where the target end is located and the main control target range. The interface configuration module is used to construct a first logical interface corresponding to the first communication link and a second logical interface corresponding to the second communication link in the centralized routing cluster of the main control range. The address configuration module is used to configure a first primary IP address on the first logical interface based on the network configuration information of the attacking end, and to configure a second primary IP address on the second logical interface based on the network configuration information of the target end. The routing orchestration module is used to create a virtual routing forwarding instance corresponding to the networking request, bind the first logical interface and the second logical interface to the routing domain of the corresponding virtual routing forwarding instance, and establish a cross-domain forwarding path from the first logical interface to the second logical interface based on the first primary IP address and the second primary IP address.

9. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the networking method of the federal network range according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the networking method of the federal network range according to any one of claims 1 to 7.

Images