Control policy storage method and apparatus, network device, and readable storage medium

Abstract

The application relates to the network technical field, in particular to a control policy storage method and device, network equipment and a readable storage medium. The method comprises the following steps: if it is determined that a source MAC address table does not have a table entry matched with a target source MAC address of a target message, an authentication result corresponding to the target source MAC address is obtained; based on information related to a first control policy corresponding to the target source MAC address in the authentication result, a first policy identifier representing the first control policy is determined; the first policy identifier and the target source MAC address are associated; if a table entry containing the first policy identifier does not exist in a hardware access control table, based on each rule in the obtained first control policy, a table entry formed by combining each rule in the first control policy with the first policy identifier is stored into the hardware access control table. The hardware resource occupation of the scheme is no longer positively related to the number of MAC addresses, but is positively related to the number of policy identifiers, so that the hardware table entry resource utilization rate is improved.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a control policy storage method, apparatus, network device, and readable storage medium. Background Technology

[0002] To improve network security, network devices need to perform MAC (Media Access Control) authentication on terminals accessing the network. After successful MAC authentication, if an authorization policy such as ACL (Access Control List) rules or URL (Uniform Resource Locator) rules is specified for the user, the network device will control the data flow from the terminal according to the issued authorization policy.

[0003] Currently, authorization policies are issued independently on a user-by-user basis. Network devices need to combine the user's MAC address and the rules in the authorization policy to form hardware entries. Therefore, the number of hardware entries required is the number of users multiplied by the number of rules.

[0004] However, when a large number of users are granted the same rules, with only their MAC addresses differing and the rest of the rules being identical, this results in a waste of hardware table entries. Summary of the Invention

[0005] This application provides a control policy storage method, apparatus, network device, and readable storage medium to solve the problem of wasted hardware table resources in the prior art.

[0006] In a first aspect, this application provides a control policy storage method, the method comprising: if it is determined that there is no entry in the source MAC address table that matches the target source MAC address of the target packet, then obtaining an authentication result for the target source MAC address, wherein the authentication result includes information related to a first control policy corresponding to the target source MAC address; determining a first policy identifier representing the first control policy based on the information related to the first control policy; associating the first policy identifier with the target source MAC address; if there is no entry in the hardware access control table that contains the first policy identifier, then storing entries formed by combining each rule in the first control policy with the first policy identifier in the hardware access control table based on each rule in the obtained first control policy.

[0007] Secondly, this application provides a message forwarding apparatus, the apparatus comprising: The authentication module is used to obtain the authentication result for the target source MAC address if it is determined that there is no entry in the source MAC address table that matches the target source MAC address of the target packet. The authentication result includes information related to the first control policy corresponding to the target source MAC address. The identifier determination module is used to determine a first strategy identifier that represents the first control strategy based on information related to the first control strategy. The association module is used to associate the first policy identifier with the target source MAC address; The storage module is used to store, based on the rules in the acquired first control policy, entries formed by combining each rule in the first control policy with the first policy identifier into the hardware access control table if there is no entry containing the first policy identifier in the hardware access control table.

[0008] Thirdly, embodiments of this application provide a control policy storage device, the control policy storage device comprising: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in memory and execute the steps of the method described in any of the first aspects above, according to the obtained program instructions.

[0009] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the steps of any of the methods described in the first aspect above.

[0010] In summary, the control policy storage method provided in this application firstly determines that if the source MAC address table does not contain an entry matching the target source MAC address of the target packet, then obtains the authentication result for the target source MAC address, wherein the authentication result includes information related to a first control policy corresponding to the target source MAC address; then, based on the information related to the first control policy, a first policy identifier representing the first control policy is determined; then, the first policy identifier is associated with the target source MAC address; subsequently, if the hardware access control table does not contain an entry containing the first policy identifier, then based on the rules in the obtained first control policy, the entries formed by combining each rule in the first control policy with the first policy identifier are stored in the hardware access control table.

[0011] The control policy forwarding method provided in this application replaces the association between control policies and MAC addresses with the association between control policies and policy identifiers. Users using the same control policy are bound to a unified policy identifier, thereby changing the resource consumption of hardware entries from being proportional to the number of MAC addresses to being proportional to the number of control policies. This reduces the redundant storage of control policies caused by binding a large number of MAC addresses and control rules, improves the utilization rate of hardware entries, and thus increases the number of users online, reducing the probability of hardware entry restrictions causing user scale bottlenecks. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0013] Figure 1 A diagram illustrating the resource usage of hardware entries provided for related technologies; Figure 2 A flowchart illustrating a control strategy storage method provided in an embodiment of this application; Figure 3 A flowchart illustrating another control strategy storage method provided in an embodiment of this application; Figure 4 A flowchart illustrating another control strategy storage method provided in an embodiment of this application; Figure 5 A schematic diagram illustrating the resource usage of hardware entries provided in this application embodiment; Figure 6 This is a schematic diagram of the structure of a control strategy storage device provided in an embodiment of this application; Figure 7 This is a schematic diagram of another control strategy storage device provided in an embodiment of this application. Detailed Implementation

[0014] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0015] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0016] When a terminal sends data to a network device for the first time, its source MAC address is unknown to the network device, triggering an authentication process. The authentication process involves the network device querying its source MAC address table based on the data's source MAC address. If a corresponding entry is found, the data is forwarded normally according to that entry. If no match is found, MAC authentication for the unknown source is performed. If authentication is successful, the source MAC address is added to the table; if authentication fails, the packet is discarded.

[0017] If authentication is successful, and if an authorization control policy is specified for the terminal, the MAC authentication authorization system offers a variety of control policy types, such as ACL (Access Control Lists) policies and URL (Uniform Resource Locator) policies. The network device will then control the flow of packets from the terminal according to the acquired control policy.

[0018] Currently, control policies are issued independently to each user. Figure 1 A diagram illustrating the resource usage of hardware entries provided for related technologies.

[0019] like Figure 1 As shown, if the control policy ACL 3000 contains 5 rules, when all four users (MAC1, MAC2, MAC3, and MAC4) are authorized to use this control policy, the device needs to instantiate these 5 rules for each user separately, occupying a total of 20 ACL hardware table entries. When MAC4, MAC5, MAC6, and MAC7 are authorized to use the control policy URL, the URL includes 3 fixed rules, namely, matching HTTP packets sent to the control layer (…). Figure 1 The rule is represented by HTTP, and it is sent to the control layer when matching HTTPS messages. Figure 1 (This rule is indicated via HTTPS), all other packets are denied (discarded). Figure 1 (The rule is indicated by "deny"). The control policy URL is also based on rules issued by the user. Therefore, the four MAC addresses occupy 12 ACL hardware entries, and the seven users from MAC1 to MAC7 occupy a total of 32 ACL hardware entries.

[0020] Therefore, the number of hardware entries used by a control policy equals the number of users multiplied by the number of rules. When a large number of users are granted the same rule, with only their MAC addresses differing, everything else is identical, resulting in significant redundant storage of ACL hardware entries. On devices with smaller ACL hardware entry specifications, this resource redundancy issue directly limits the maximum number of concurrent users, creating a performance bottleneck.

[0021] To address the technical problem of resource redundancy in ACL hardware entries in network devices, this application provides a control policy storage method. The core idea of ​​this method is as follows: First, when a packet with an unknown source MAC enters the network device, the network device triggers MAC authentication. If the authentication is successful, a policy identifier is assigned to the control policy corresponding to the source MAC, and the policy identifier is associated with the source MAC address.

[0022] Secondly, when storing control policies, network devices no longer construct ACL hardware entries based on MAC addresses and rules within the control policy. Instead, they construct ACL hardware entries based on policy identifiers and rules within the control policy. This ensures that a control policy represented by a policy identifier is stored only once, and all source MAC addresses under the same control policy share the same control policy. Therefore, when multiple users share the same control policy, the reuse rate of ACL hardware entry resources can be significantly improved, enabling network devices to support more concurrent users with limited hardware entry resources.

[0023] Subsequently, when the packet enters the ACL processing stage during forwarding, the network device determines the policy identifier associated with the source MAC address of the packet, and directly controls the flow of the packet based on the rules in the control policy represented by the policy identifier, such as allowing, denying or redirecting.

[0024] In summary, this application's embodiments replace the association of control policies with MAC addresses with the association of control policies with policy identifiers. This categorizes MAC addresses according to control policies and binds them to policy identifiers, allowing users using the same control policy to be bound to a unified policy identifier, thus enabling policy rules to be reused among users. Furthermore, the matching keywords for hardware access control list entries are reduced from a massive number of "MAC addresses" to a smaller number of "policy identifiers." This method decouples control policies from MAC addresses, reducing redundant storage of control policies caused by associating a large number of MAC addresses with control rules. It also changes the resource consumption of hardware entries from being proportional to the number of MAC addresses to being proportional to the number of control policies, improving hardware entry resource utilization and consequently increasing the number of online users, while reducing the probability of hardware entry restrictions causing user scale bottlenecks.

[0025] For example, see Figure 2The diagram shown is a flowchart illustrating a control policy storage method provided in an embodiment of this application. The control policy storage method provided in this embodiment can be applied to network devices. The network device is a device capable of receiving packets, performing MAC authentication, and providing hardware table resources; for example, it can be a switch. This embodiment does not intend to limit the type of network device; the specific type can be selected based on actual needs.

[0026] In this embodiment of the application, the network device may include a processor and a dedicated chip.

[0027] The processor is responsible for control plane processing and can be a general-purpose processor (such as ARM, MIPS, x86 architecture). It is good at handling complex logic, running operating systems and various protocol software.

[0028] The dedicated chip is responsible for line-speed forwarding of the data plane. It is a dedicated integrated circuit that is implemented through hardware logic. It has an extremely fast processing speed (nanosecond level) and low power consumption.

[0029] A dedicated chip may include a source MAC address table and a hardware access control table.

[0030] The source MAC address table records entries for authenticated source MAC addresses. These entries may include the MAC address, VLAN (Virtual Local Area Network), outgoing interface, MAC attributes (such as any one of authenticated MAC, dynamic MAC, or static MAC), and a class identifier (CLASSID). It should be noted that the content of the above entries is merely an example and does not constitute a specific limitation; the content of the entries can be designed according to actual needs.

[0031] Hardware access control lists (HALists) are lists of hardware accessed directly through dedicated chips in network devices, providing hardware entry resources, which are limited. For example, a hardware access control list can be a hardware ACL.

[0032] like Figure 2 As shown, in step 200, if the network device determines that there is no entry in the source MAC address table that matches the target source MAC address of the target packet, it obtains the authentication result for the target source MAC address. The authentication result includes information related to the first control policy corresponding to the target source MAC address.

[0033] The target message is any message received by the network device from the terminal that contains the source MAC address. For example, the terminal can be a mobile phone, tablet, desktop, laptop, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose any special limitations on the specific form of the device.

[0034] The target source MAC is the source MAC address in the target packet.

[0035] The authentication result is used to characterize the result of MAC authentication, and may include MAC type. In this embodiment, only the case of successful authentication is considered. Correspondingly, the MAC type is the authenticated MAC.

[0036] Furthermore, the authentication result may also include information related to a first control policy corresponding to the target source MAC address. The first control policy is used to control the flow of packets containing the target source MAC address. The information related to the first control policy describes the first control policy and may include an identifier for the first control policy. For example, if the first control policy can be distinguished solely by its type, without needing a number, such as a URL policy, then the identifier for the first control policy could be its policy type. For example, if the first control policy requires both type and number to distinguish it, such as an ACL policy, then the identifier for the first control policy could be both its policy type and its number.

[0037] In this embodiment of the application, when a network device receives a target packet from a terminal, it can query the source MAC address table based on the target source MAC address of the target packet. If there is no table entry that matches the target source MAC address, it indicates that the target source MAC address is an unknown source, and MAC authentication is triggered.

[0038] Before MAC authentication, it is necessary to pre-store the authorized MAC address table, configure several control policies, and establish the mapping relationship between MAC addresses and control policies.

[0039] MAC authentication involves determining the first control policy corresponding to the target source MAC address based on the mapping relationship between the authorized MAC address and the control policy, if the authorized MAC address table contains an entry for the target source MAC address, then the authentication is successful.

[0040] In some embodiments, a dedicated chip in a network device receives a target packet, parses the target packet to obtain the target source MAC address, and queries the source MAC address table based on the target source MAC address. If no entry matching the target source MAC address is found, it indicates that the source MAC address is an unknown source, triggering the processor in the network device to perform MAC authentication. For example, it sends an authentication trigger request to the processor in the network device. The authentication trigger request may include the target packet, or the authentication trigger request may be an authentication trigger event generated based on the target source MAC address of the target packet.

[0041] In some cases, if MAC authentication is remote, the processor in the network device can generate an authentication request based on the target source MAC address and send it to the authentication server. For example, the target source MAC address can be encapsulated into a standard RADIUS (Remote Authentication Dial In User Service) protocol message according to a configured format (e.g., username=mac password=mac) and sent to the authentication server. The authentication server performs MAC authentication, obtains the authentication result, and sends it to the network device. The authentication server is specifically used for MAC authentication. If the authorized MAC address table and the mapping relationship between authorized MAC addresses and control policies are not stored on the authentication server but rather on a user information storage device, the authentication server can query the user information storage device to obtain the authorized MAC address table and the mapping relationship between authorized MAC addresses and control policies, thereby achieving MAC authentication.

[0042] In some cases, if MAC authentication is local authentication, and the authorized MAC address table and the mapping relationship between authorized MAC addresses and control policies are stored locally on the network device, then the processor in the network device can perform MAC authentication in response to the authentication trigger request sent by the dedicated chip.

[0043] In step 210, the network device determines a first policy identifier that represents the first control policy based on information related to the first control policy.

[0044] In this embodiment, the first policy identifier is used to represent the first control policy. If the control policies are the same, the policy identifiers representing the control policies are the same. The policy identifier can be used as a matching item in the hardware access control table. It can be represented as a binary number with a specific number of bits. The number of bits can be designed based on the actual hardware capabilities of the network device and the number of control policies required. Furthermore, the binary number with a specific number of bits can be functionally divided according to actual needs to obtain binary numbers with different functions, thereby identifying the control policy.

[0045] For example, the policy identifier is 10 bits, which are functionally divided. The first bit (the highest bit) represents the authentication identifier, with 1 indicating an authenticated MAC and 0 indicating a non-authenticated MAC. Bits 2-4 (3 bits) represent the policy type of the control policy, which can identify three main authorization types: 001 represents an authorized ACL, 010 represents an authorized URL, and 100 represents other authorization types. Bits 5-10 (6 bits) are flexible extension bits, with different numbers representing different meanings, supporting up to 127 sub-policy identifiers (such as different ACL numbers).

[0046] In some embodiments, the first control policy may be a policy that does not need to be distinguished by number, such as a URL policy. The generation of the authorization policy only needs to be concerned with the policy type of the first control policy. Correspondingly, the relevant information of the first control policy includes the policy type of the first control policy.

[0047] In step 120, the network device first determines a first bit value based on the policy type of the first control policy. This first bit value represents the policy type of the first control policy. The first bit value can be the numerical state of several bits, and the specific number of bits can be determined based on actual needs. For example, if there are two policy types, the number of bits can be greater than or equal to two. In some implementations, the network device pre-sets several mapping relationships between policy types and bit values. For example, 001 represents an authorized ACL, 010 represents an authorized URL, and 100 represents other authorized types. Then, based on these mapping relationships, the network device determines the bit value mapped to the policy type of the first control policy and uses this bit value as the first bit value.

[0048] Then, the network device determines a first policy identifier representing the first control policy based on the first bit value. In some implementations, the network device pre-sets the number of bits used for control policy classification (for ease of description and distinction, this can be called the classification bit number), for example, 6 bits. Then, the network device determines the classification number for the first control policy; considering that the first control policy does not require further subdivision, the classification number for the first control policy is 0. Then, based on the classification bit number, the classification number for the first control policy is converted to binary to obtain a bit value, and this bit value is concatenated with the first bit value to obtain the first policy identifier.

[0049] For example, the authentication result includes MAC type: Authentication MAC, and information related to the first control policy. The related information includes policy type: URL. For MAC type: Authentication MAC, the first bit is set to 1. The 3 bits representing the policy type URL of the control policy have a value of 010. There is no need to distinguish it by the control policy number. Therefore, the 6 bits representing the classification number of the control policy have a value of 000000, and the final policy identifier is 1010000000.

[0050] In some embodiments, the first control policy may be a policy that needs to be distinguished by a number, such as an ACL policy. Generating an authorization policy requires attention to the policy type and the number of the first control policy. Correspondingly, the relevant information of the first control policy includes the policy type and the number of the first control policy.

[0051] In step 120, the network device first determines the first bit value based on the policy type of the first control policy. The first bit value is used to characterize the policy type of the first control policy.

[0052] Then, based on the number of the first control policy, a second bit value is determined. This second bit value represents the number of the first control policy and can be the value of several individual bits. The specific number of bits can be determined by considering the number of control policies under the policy type. For example, if there are 100 control policies, the number of bits can be greater than or equal to 6. In some implementations, the network device can pre-set the number of classification bits used for control policy classification, such as 6 bits. Then, based on the number of the first control policy, the network device determines the classification number for that first control policy. Based on the number of classification bits, the classification number for that first control policy is binary converted to obtain a bit value, which is used as the second bit value.

[0053] Finally, based on the first bit value and the second bit value, a first strategy identifier representing the first control strategy is determined, for example, by concatenating the first bit value and the second bit value to obtain the first strategy identifier.

[0054] For example, the authentication result includes MAC type: Authentication MAC, and information related to the first control policy, including policy type: ACL and policy number (ACL number): 3000. For MAC type: Authentication MAC, the first bit is 1. In the three bits of the authorization type, 001 represents the authorization ACL, so the first four bits of classid are 1001. Since the authorization ACL can authorize different ACL numbers, and the rules for different ACL numbers are different, all authorization ACLs need to use the last 6 bits for flexible use. Requesting classification number = 1 represents ACL 3000, so the value of the 6 bits representing the classification number of the control policy is 000001, and the final policy identifier is 1001000001.

[0055] In some embodiments, the processor of the network device determines a first policy identifier representing the first control policy based on information related to the first control policy. If the processor is divided into a control layer and a driver layer, after the control layer obtains the authentication result, it sends the information related to the first control policy in the authentication result to the driver layer, and the driver layer determines the first policy identifier representing the first control policy based on the information related to the first control policy.

[0056] In step 220, the network device associates the first policy identifier with the target source MAC address.

[0057] In this embodiment of the application, if different source MAC addresses all correspond to the first control policy, then the first control policy is associated with the different source MAC addresses.

[0058] For example, if MAC address 1, MAC address 2, and MAC address 3 all correspond to control policy ACL 3000, and the policy identifier of ACL 3000 is 1001000001, then 1001000001 is associated with MAC address 1, MAC address 2, and MAC address 3.

[0059] In some embodiments, the processor of the network device associates a first policy identifier with a target source MAC address. If the processor is divided into a control layer and a driver layer, the control layer sends the target source MAC address to the driver layer. Based on information related to the first control policy, the driver layer determines the first policy identifier representing the first control policy and then sends the association between the first policy identifier and the target source MAC address to a dedicated chip for storage. It should be noted that the dedicated chip needs to store a copy of the first policy identifier, which is bound to the target source MAC address.

[0060] In step 230, if the network device does not have an entry containing the first policy identifier in the hardware access control table, it stores the entries formed by combining each rule in the first control policy with the first policy identifier into the hardware access control table based on the rules in the first control policy obtained.

[0061] In some embodiments, to determine whether a hardware access control table (HACCP) contains an entry with a first policy identifier, the network device may match the first policy identifier with policy identifiers in HACCP entries. If no policy identifier is matched in an HACCP entry, it is determined that no HACCP entry containing the first policy identifier exists. If a policy identifier is matched in an HACCP entry, it is determined that an HACCP entry containing the first policy identifier exists.

[0062] In some implementations of this embodiment, the processor of the network device includes a driver layer that stores a soft table of a hardware access control table. The soft table records the mapping relationship between control policies, policy identifiers, and rules in the control policies. Correspondingly, the driver layer can query the soft table of the hardware access control table based on a first policy identifier. If the first policy identifier exists in the soft table, it means that a policy identifier in an entry of the hardware access control table is matched; otherwise, no policy identifier in an entry of the hardware access control table is matched.

[0063] In some embodiments, regarding the acquisition of each rule in the first control policy, if the first control policy is stored locally on the network device, the processor of the network device can read each rule in the first control policy from the local storage based on information related to the first control policy. If the first control policy is not stored locally on the network device and is issued by the authentication server, the processor of the network device can receive each rule in the first control policy issued by the authentication server. It should be noted that the embodiments of this application do not intend to limit the timing of the authentication server issuing each rule in the first control policy. For example, the authentication server can issue each rule in the first control policy at the same time as issuing the authentication result, or it can place each rule in the first control policy in the authentication result, or it can issue each rule in the first control policy after issuing the authentication result.

[0064] In this embodiment, if the hardware access control table does not contain an entry with the first policy identifier, the network device will combine each rule in the first control policy with the first policy identifier to form an entry and store it in the hardware access control table. It should be noted that this embodiment does not intend to limit the order in which the network device determines whether the hardware access control table contains an entry with the first policy identifier, or the order in which the network device obtains the rules in the first control policy. The specific design can be tailored to the actual scenario requirements. For example, the network device can first obtain the rules in the first control policy, and then determine whether the hardware access control table contains an entry with the first policy identifier.

[0065] For example, the hardware access control list is a hardware ACL. When MAC address 1 is authorized by the control policy ACL 3000, ACL 3000 includes 5 rules: rule1, rule2, rule3, rule4, and rule5. The policy identifier of ACL 3000 is 1001000001, and 1001000001 is bound to MAC address 1, then for each rule, the network device combines the rule and 1001000001 into an ACL entry and stores it in the hardware ACL. There are a total of 5 ACL hardware entries, namely "1001000001+ rule1", "1001000001+ rule2", "1001000001+ rule3", "1001000001+ rule4", and "1001000001+ rule5".

[0066] In some implementations of this embodiment, the processor of the network device includes a driver layer that stores the association between MAC addresses and policy identifiers. The control layer of the processor of the network device obtains each rule in the first control policy. For each rule in the first control policy, the control layer sends the target source MAC address and the rule to the driver layer. Based on the target source MAC address, the driver layer queries the association between the MAC address and the policy identifier to obtain the first policy identifier associated with the target source MAC address, and sends the entry formed by combining the first policy identifier and the rule to a dedicated chip for storage.

[0067] In this embodiment of the application, if the hardware access control table contains an entry containing a first policy identifier, in some implementations, the network device can discard each rule in the acquired first control policy. For example, the network device's processor will not send the rules in the first control policy to the dedicated chip, thereby avoiding duplicate storage of the first control policy. In other implementations, if the first control policy is sent by the authentication server, the network device can send a target instruction to the authentication server. The target instruction is used to instruct the authentication server to stop sending each rule in the first control policy to the network device, thereby eliminating the need for the network device to receive the first control policy sent by the authentication server and avoiding duplicate storage of the first control policy.

[0068] This solution introduces a policy identifier as an intermediate abstraction layer, constructing a two-level mapping of "MAC address → policy identifier → control policy," thereby decoupling MAC addresses from control policies. Furthermore, by categorizing user MAC addresses according to control policies and binding them to policy identifiers, policy rules can be reused among users. This optimizes the resource consumption of hardware entries from being proportional to the number of users to being proportional to the number of policy categories, reducing the probability of hardware entry limitations causing bottlenecks in user scale. Thus, with the same hardware entry resources, network devices using this solution can support several times or even tens of times more authenticated users, addressing the pain point of low-to-mid-range network devices being unable to support large-scale user access due to hardware entry resource limitations.

[0069] For example, see Figure 3 The diagram shown is a flowchart illustrating another control strategy storage method provided in an embodiment of this application.

[0070] like Figure 3 Therefore, in step 300, if the network device determines that there is no entry in the source MAC address table that matches the target source MAC address of the target packet, it obtains the authentication result for the target source MAC address. The authentication result includes information related to the first control policy corresponding to the target source MAC address and information related to the second control policy corresponding to the target source MAC address.

[0071] For details, please refer to the description of step 200, which will not be repeated here. The only difference is that there are multiple control policies corresponding to the target source MAC address, which leads to different authentication results.

[0072] In step 310, the network device determines a first policy identifier representing the first control policy based on information related to the first control policy; and determines a second policy identifier representing the second control policy based on information related to the second control policy.

[0073] For details, please refer to the description of step 210, which will not be repeated here. Based on the information related to the second control strategy, the details of determining the second strategy identifier that represents the second control strategy can be found in the first control strategy, the difference being that the first control strategy is changed to the second control strategy.

[0074] In step 320, the network device associates the first policy identifier and the second policy identifier with the target source MAC address, respectively.

[0075] In step 330, if the network device does not have an entry containing the first policy identifier in the hardware access control table, it stores each rule in the first control policy and the entries formed by combining them with the first policy identifier into the hardware access control table based on the rules in the first control policy obtained.

[0076] For details, please refer to the description of step 230, which will not be repeated here.

[0077] In step 340, if the network device does not have an entry containing the second policy identifier in the hardware access control table, it stores each rule in the second control policy and the entries formed by combining them with the second policy identifier into the hardware access control table based on the rules in the obtained second control policy.

[0078] For details, please refer to the description of step 230, which will not be repeated here. The difference is that the first control strategy is changed to the second control strategy.

[0079] It should be noted that the embodiments of this application are not intended to limit the execution order of steps 330 and 340. They can be executed in parallel or sequentially. The specific design can be combined with the actual situation. For example, when the processor utilization of the network device is high, steps 330 and 340 can be executed sequentially. When the processor utilization of the network device is low, steps 330 and 340 can be executed in parallel.

[0080] In this solution, when a user authorizes multiple authorization policies, each authorization policy is assigned a policy identifier and bound to the user's MAC address. In this way, an authorization policy only occupies one hardware table entry, eliminating the need for redundant storage and thus improving the utilization rate of hardware table entry resources.

[0081] For example, see Figure 4 The diagram shown is a flowchart illustrating another control strategy storage method provided in an embodiment of this application.

[0082] like Figure 4Therefore, in step 400, if the network device determines that there is no entry in the source MAC address table that matches the target source MAC address of the target packet, it obtains the authentication result for the target source MAC address. The authentication result includes information related to the first control policy corresponding to the target source MAC address and information related to the second control policy corresponding to the target source MAC address.

[0083] For details, please refer to the description of step 200, which will not be repeated here. The only difference is that there are multiple control policies corresponding to the target source MAC address, which leads to different authentication results.

[0084] In step 410, the network device determines a first policy identifier that represents the first control policy and the second control policy based on information related to the first control policy and information related to the second control policy.

[0085] In this embodiment of the application, if the target source MAC address can only correspond to one policy identifier, and the target source MAC address corresponds to multiple control policies, multiple control policies can be represented by one policy identifier.

[0086] In some embodiments, the target source MAC address corresponds to a first control policy and a second authorization policy.

[0087] In some implementations of this embodiment, the first control policy can be a policy that needs to be distinguished by a number, such as an ACL policy. Correspondingly, the relevant information of the first control policy includes the policy type and the number of the first control policy. The second control policy can be a policy that does not need to be distinguished by a number, such as a URL policy. Correspondingly, the relevant information of the second control policy includes the policy type of the second control policy.

[0088] Correspondingly, in step 410, the network device first determines the first bit value representing the policy type of the first control policy and the policy type of the second control policy based on the policy type of the first control policy and the policy type of the second control policy. In some implementations, the network device pre-sets several mapping relationships between policy types and bit values, such as 001 representing authorized ACL, 010 representing authorized URL, and 100 representing other authorized types. Then, based on the several mapping relationships between policy types and bit values, it determines the bit value 1 of the policy type mapping of the first control policy and the bit value 2 of the policy type mapping of the second control policy. The bit value 1 of the policy type mapping of the first control policy and the bit value 2 of the policy type mapping of the second control policy are summed, and the summation result is the first bit value.

[0089] Then, the network device determines the second bit value representing the number of the first control policy based on the number of the first control policy. In some implementations, the network device can pre-set a preset number of bits, such as 6 bits, for the control policy classification; then, based on the number of the first control policy, the network device determines the classification number for the first control policy, and performs a binary conversion on the classification number for the first control policy based on the number of classification bits to obtain a bit value, which is used as the second bit value.

[0090] Subsequently, the network device determines a first policy identifier representing the first control policy and the second control policy based on the first feature and the second bit value, for example, by concatenating the first bit value and the second bit value to obtain the first policy identifier.

[0091] For example, control policy 1 is of ACL type and policy number 3000, control policy 2 is of URL type. The 3 bits representing the policy type of control policy 1 are 001, and the 3 bits representing the policy type of control policy 2 are 010. Therefore, the 3 bits representing the type of control policy 1 and control policy 2 are 001 + 010 = 011. The category number assigned to control policy 1 (policy number 3000) is 1, so the 6 bits representing the category number of control policy 1 are 000001. The category number assigned to control policy 2 (URL) is 0, so the 6 bits representing the category number of control policy 2 are 000000. Therefore, the final category number of control policy 1 and control policy 2 is 000001. The first digit being 1 indicates MAC authentication, so the policy identifier of control policy 1 and control policy 2 is 1011000001.

[0092] In some possible implementations, the first control policy can be a policy that needs to be distinguished by a number, such as an ACL policy. Correspondingly, the relevant information of the first control policy includes its policy type and its number. The second control policy is also a policy that needs to be distinguished by a number, such as a URL policy. Correspondingly, the relevant information of the second control policy includes its policy type and its number.

[0093] Correspondingly, in step 410, the network device first determines the first bit value representing the policy type of the first control policy and the policy type of the second control policy based on the policy type of the first control policy and the policy type of the second control policy.

[0094] Then, the network device determines the second bit value representing the first control policy number and the second control policy number based on the first control policy number and the second control policy number. In some implementations, the network device can pre-set a preset number of bits used for control policy classification, such as 6 bits. Then, based on the first control policy number, the network device determines a classification number 1 for that first control policy, performs a binary conversion on the classification number 1 based on the classification bit number, and obtains bit value 1; and, based on the second control policy number, it determines a classification number 2 for that second control policy, performs a binary conversion on the classification number 2 based on the classification bit number, and obtains bit value 2. The bit value 1 obtained from the binary conversion of the first control policy classification number 1 and the bit value 2 obtained from the binary conversion of the second control policy classification number 2 are summed, and the sum is the second bit value.

[0095] Subsequently, based on the first bit feature and the second bit value, a first strategy identifier representing the first control strategy and the second control strategy is determined.

[0096] For example, if control policy 1 has a policy type of ACL and a policy number of 3000, and control policy 2 has a policy type of ACL and a policy number of 3100, and the 3 bits representing the ACL type have a value of 001, then the 3 bits representing the policy type of control policy 1 and control policy 2 have a value of 001. If the policy number 3000 of control policy 1 is assigned a category number of 1, then the 6 bits representing the category number of control policy 1 have a value of 000001. If the policy number 3100 of control policy 2 is assigned a category number of 2, then the 6 bits representing the category number of control policy 2 have a value of 000010. Therefore, the final category number of control policy 1 and control policy 2 is 000011, and the policy identifier of control policy 1 and control policy 2 is 1001000011.

[0097] In step 430, the network device associates the first policy identifier with the target source MAC address.

[0098] In step 440, if the network device does not have an entry containing the first policy identifier in the hardware access control table, it stores the entries formed by combining the rules in the first control policy and the first policy identifier in the hardware access control table based on the rules in the first control policy and the rules in the second control policy.

[0099] For example, the hardware access control list is a hardware ACL. When MAC address 1 is authorized by two control policies, control policy 1: ACL 3000 and control policy 2: URL, and the policy identifier representing ACL 3000 and URL is 1011000001, 1011000001 is bound to MAC address 1, ACL 3000 includes 5 rules: rule1, rule2, rule3, rule4, and rule5, and URL includes 3 rules: http, https, and deny, then for each rule in ACL 3000, the network device combines that rule with 1011000001 to form an ACL entry and stores it in the hardware ACL, for a total of 5 ACL entries, namely "1001000001+rule1", "1001000001+rule2", "1001000001+rule3", "1001000001+rule4", and "1001000001+rule5". For each rule in the URL, the network device combines the rule with 1011000001 to form an ACL entry and stores it in the hardware ACL. There are a total of 3 ACL entries, namely "1001000001+ http", "1001000001+ https", and "1001000001+ deny".

[0100] In this scheme, where only one policy identifier can be bound to a MAC address, if a user authorizes multiple control policies, a single policy identifier can be assigned to each control policy and bound to the user's MAC address, thus decoupling multiple control policies from their MAC addresses. Additionally, while assigning a policy identifier to a single control policy might lead to redundant storage, this is relatively rare and will not significantly consume hardware table resources. Compared to schemes that associate MAC addresses with control policies, this scheme still improves hardware resource utilization.

[0101] In the above Figures 2 to 4 Based on the control policy storage method shown, the control policy can also be updated, which may include adding, deleting, and modifying. In some embodiments, if it is necessary to update the first control policy, the network device can obtain an update instruction for the first control policy. The update instruction can be any one of a rule replacement instruction, a rule addition instruction, or a rule deletion instruction. The rule replacement instruction is used to indicate that the first rule in the first control policy is updated to a second rule. The rule addition instruction is used to indicate that a third rule is added to the first control policy. The rule deletion instruction is used to indicate that a fourth rule is deleted from the first control policy. The first rule and the fourth rule are any rule in the first control policy, and the second rule and the third rule can be any rule other than the first control policy.

[0102] Regarding the acquisition of update instructions, if the first control policy is stored locally on the network device, the network device's processor can directly acquire the update instruction sent by the operating device of the first control policy, which can be a terminal. If the first control policy is issued by an authentication server, the network device's processor can receive the update instruction issued by the authentication server, thereby acquiring the update instruction.

[0103] In some embodiments, if the update instruction is a rule replacement instruction, the network device can respond to the rule replacement instruction and replace the entry in the hardware access control table formed by the combination of the first rule and the first policy identifier with the entry formed by the combination of the second rule and the first policy identifier.

[0104] In some implementations of this embodiment, the network device may delete the entry formed by the combination of the first rule and the first policy identifier in the hardware access control table, and store the entry formed by the combination of the second rule and the first policy identifier in the hardware access control table.

[0105] For example, the processor of the network device includes a control layer that acquires rule replacement instructions. The driver layer of the network device's processor stores a soft table of hardware access control tables, which records the mapping relationship between control policies, policy identifiers, and rules within the control policies. It should be noted that one control policy can correspond to one or more policy identifiers; for example, when using... Figure 3 The control policy storage method shown uniquely assigns one policy identifier to each control policy. Figure 4 The control policy storage method shown allows one control policy to correspond to multiple policy identifiers. Among these, one policy identifier is used to represent the control policy, while the other policy identifiers are used to represent the combination of the control policy and other control policies.

[0106] For example, if a rule in the control strategy can be directly replaced, the rule replacement instruction includes information related to the first control strategy, information related to the first rule that needs to be updated, such as the rule number, and the second rule after the first rule is updated.

[0107] Correspondingly, the control layer can send information related to the first control policy and information related to the first rule to the driver layer. The driver layer can query the soft table of the hardware access control table based on the information related to the first control policy. If the first control policy exists in the soft table, for each policy identifier associated with the first control policy in the soft table (which can be called the target policy identifier for ease of description and distinction), based on the information related to the first rule, delete the table entry in the hardware access control table that contains the target policy identifier and the first rule.

[0108] Next, the control layer sends the updated second rule to the driver layer. The driver layer then sends the entry formed by combining the target policy identifier and the second rule to a dedicated chip for storage.

[0109] For example, if the update of a certain rule in the control strategy is achieved by updating the control strategy as a whole, the rule replacement instruction includes information related to the first control strategy and each rule in the updated first control strategy.

[0110] Correspondingly, the control layer can send information related to the first control policy to the driver layer. The driver layer can query the soft table of the hardware access control table based on the information related to the first control policy. If the first control policy exists in the soft table, for each target policy identifier associated with the first control policy in the soft table, all entries in the hardware access control table that contain the target policy identifier are deleted.

[0111] Next, for each rule in the updated first control policy, the control layer sends the rule to the driver layer. For each target policy identifier, the driver layer sends the entry formed by combining the target policy identifier and the rule to a dedicated chip for storage.

[0112] It should be noted that the above implementation is merely an example and does not constitute a specific limitation. In some implementations, the network device may directly store the entry formed by the combination of the first rule and the first policy identifier in the hardware access control table without deleting the entry formed by the combination of the first rule and the first policy identifier, and modify the access address of the entry formed by the combination of the first rule and the first policy identifier to the access address of the entry formed by the combination of the second rule and the first policy identifier.

[0113] In some embodiments, if the update instruction is a rule addition instruction, the network device can respond to the rule addition instruction by storing the entry formed by combining the third rule and the first policy identifier in the rule addition instruction into the hardware access control table. It should be noted that the network device can directly add an entry formed by combining the third rule and the first policy identifier based on the hardware access control table. Alternatively, the network device can first delete the entry in the hardware access control table containing each target policy identifier associated with the first control policy, and then, for each target policy identifier, store the entry formed by combining each rule in the first control policy after adding the third rule and the target policy identifier into the hardware access control table, thereby realizing the addition of rules for the first control policy.

[0114] In some embodiments, if the update instruction is a rule deletion instruction, the network device can respond to the rule deletion instruction and store the entry formed by combining the target rule in the rule deletion instruction with the first policy identifier in the hardware access control table. It should be noted that the network device can directly delete the entry formed by combining the fourth rule with the first policy identifier based on the hardware access control table. Alternatively, the network device can first delete the entry in the hardware access control table containing each target policy identifier associated with the first control policy, and then, for each target policy identifier, store the entry formed by combining each rule in the first control policy after deleting the fourth rule with the target policy identifier in the hardware access control table, thereby achieving the deletion of any rule of the first control policy.

[0115] In the above Figures 2 to 4 Based on the control policy storage method shown, the network device's processor, in addition to recording the association between policy identifiers and target source MAC addresses in the source MAC address table of the dedicated chip, also records the information required for packet forwarding targeting the target source MAC address in the source MAC address table of the dedicated chip. The information required for packet forwarding may include the outgoing port and VLAN targeting the target source MAC address, thereby facilitating subsequent packet forwarding. It should be noted that the target source MAC address and the information required for packet forwarding targeting the target source MAC address are combined to form an entry stored in the source MAC address table, and the entry in the source MAC address table is associated with the policy identifier.

[0116] During the forwarding of the target packet, the target packet enters the dedicated chip of the network device. Based on the target source MAC address of the target packet, the dedicated chip queries the source MAC address table to obtain the entry that matches the target source MAC address. Based on the policy identifier associated with the entry, it queries the hardware access control table to obtain the entry that matches the policy identifier. Based on the rules in the entry that matches the policy identifier, it controls the flow of the target packet, such as allowing, denying, or redirecting it.

[0117] The following section combines specific application scenarios and... Figure 5 The control policy storage method provided in the embodiments of this application will be described in detail. In the following description, the policy identifier is referred to as classid, the source MAC address is abbreviated as MAC, and the hardware access control table is abbreviated as hardware ACL.

[0118] Application Scenario: Seven users are coming online and need to be authenticated through a remote authentication server. The authentication server is configured as follows: MAC1, MAC2, and MAC3 are authorized with the control policy ACL 3000; MAC4 is authorized with two control policies: ACL 3000 and URL; MAC5, MAC6, and MAC7 are authorized with the control policy URL. There are no matching entries for MAC1, MAC2, MAC3, MAC5, MAC6, and MAC7 in the source MAC address table of the network device.

[0119] Network devices include CPUs and dedicated chips. The CPU is divided into a control layer and a driver layer. The dedicated chip includes hardware ACLs, and the driver layer includes a software table of the hardware ACLs. This software table records the mapping relationship between control policies, class IDs, and rules in the control policies.

[0120] The classid specification is 10 bits. The first bit (the highest bit) represents the authentication identifier, with 1 indicating an authenticated MAC and 0 indicating a non-authenticated MAC. The second to fourth bits (3 bits) represent the authorization type identifier, where 001 represents an authorized ACL, 010 represents an authorized URL, and 100 represents other authorization types. The fifth to tenth bits (6 bits) are flexible extension bits, which represent different meanings according to the authorization type, supporting up to 127 sub-policy identifiers (such as different ACL numbers).

[0121] MAC1 is authorized by ACL 3000. The control layer requests the authentication server to authenticate MAC1. After successful authentication, the authentication server sends the MAC type, policy type (ACL), and ACL number (3000) to the control layer. The control layer then sends the MAC type, policy type (ACL), and ACL number (3000) to the driver layer. The driver layer, based on the MAC type (authentication MAC), policy type (ACL), and ACL number (3000), sets the classid corresponding to ACL 3000. The highest bit is set to 1 to represent the authentication MAC. The three bits of the authorization type (001) represent the authorization ACL, so the first four bits of the classid are 1001. Class number 1 is requested to represent ACL 3000, and the six bits representing class number 1 are 000001. The final classid1 is 1001000001. This classid is bound to MAC1, and the ACL number classid entry bound to classid1 is recorded. The ACL number classid entry records the ACL number, the ACL number's class number (1), and the user count. The control layer then sends the ACL to the driver layer. When there are 5 rules in ACL 3000, if the driver layer does not find classid1 in the software table of the hardware ACL, it will combine classid1 with the 5 rules in ACL 3000 to form 5 ACL entries and send them to the hardware ACL. At this time, it will occupy the resources of 5 ACL hardware entries. Similarly, MAC2 and MAC3 have both authorized ACL 3000 and both are bound to classid1. At the same time, every time classid1 is bound, the user count of classid1 is incremented by 1. If classid1 is already found in the software table of the hardware ACL before the driver layer sends the authorization ACL 3000 to the hardware ACL, it will not send it again.

[0122] MAC4 authorizes ACL 3000 and the URL policy. For ACL 3000, the driver layer queries the ACL number classidentry and finds ACL 3000, so the user count for ACL 3000 is incremented by 1. Of the three bits for the authorization type, 010 represents the authorized URL and 001 represents the authorized ACL, so the high four bits of classid are 1011 (representing authorized URL + authorized ACL). Authorized URLs do not require a class number, while ACL 3000 requests a class number: 1. The six bits representing class number 0 have a value of 000001, so the final classid2 is 1011000001. This classid2 is bound to MAC4, and the user count bound to classid2 is recorded. When the control layer sends the five rules from ACL 3000 to the driver layer, the driver layer queries the hardware ACL's soft table and does not find classid2. Therefore, classid2 and ACL... The 5 rules in 3000 form 5 ACL entries and are sent to the hardware ACL, which consumes 5 ACL hardware entry resources. When the control layer sends 3 rules in the authorization URL to the driver layer, the driver layer does not find classid2 in the software table of the hardware ACL. It then forms 3 ACL entries with classid2 and the 3 rules in the URL policy and sends them to the hardware ACL, which consumes 3 ACL hardware entry resources. MAC4 sends a total of 8 ACL hardware entry resources.

[0123] MAC5 authorizes the URL policy. In the three bits of the authorization type, 010 represents the authorized URL. The authorized URL does not require requesting an ACL number, and the final classid3 is 1010000000. This classid3 is bound to MAC5, and the user count bound to classid3 is recorded. When the control layer sends the rules from the authorized URL to the driver layer, if the driver layer does not find classid3 in the hardware ACL's soft table, it will create three ACL entries with classid3 and the three rules from the URL policy and send them to the hardware ACL, thus occupying three ACL hardware entry resources. Similarly, MAC6 and MAC7 both authorize URLs and bind classids. Each time classid3 is bound, the user count for classid3 is increased by 1. If the driver layer finds classid3 in the hardware ACL's soft table before sending the authorized URL, it will not send it again.

[0124] Ultimately, these 7 users, after coming online, occupied 16 ACL hardware table entries, compared to 32 ACL hardware table entries before optimization. The optimization significantly saved ACL hardware table entry resources, and the more users repeatedly grant the same ACL, the more pronounced the optimization effect becomes. Additionally, for the user count by classid, the user count is decremented by 1 when a user goes offline. If the user count reaches 0, the entry containing that classid in the hardware ACL can be deleted.

[0125] For example, see Figure 6 The diagram shown is a structural schematic of a control policy storage device provided in an embodiment of this application. The device includes an authentication module 601, an identifier determination module 602, an association module 603, and a storage module 604. The authentication module 601 is used to obtain an authentication result for the target source MAC address if it is determined that there is no entry in the source MAC address table that matches the target source MAC address of the target packet. The authentication result includes information related to the first control policy corresponding to the target source MAC address. The identifier determination module 602 is used to determine a first strategy identifier that represents the first control strategy based on information related to the first control strategy. Association module 603 is used to associate the first policy identifier with the target source MAC address; The storage module 604 is used to store, based on the rules in the acquired first control policy, the entries formed by combining each rule in the first control policy with the first policy identifier into the hardware access control table if there is no entry containing the first policy identifier in the hardware access control table.

[0126] In some embodiments, the relevant information includes the policy type of the first control policy, which is a policy that does not need to be distinguished by a number; The identifier determination module 602 is used to determine a first bit value based on the strategy type of the first control strategy; and to determine a first strategy identifier representing the first control strategy based on the first bit value.

[0127] In some implementations of this embodiment, the first control strategy is a strategy that needs to be distinguished by a number, and the relevant information also includes the number of the first control strategy; The identifier determination module 602 is used to determine a second bit value based on the number of the first control strategy; and to determine a first strategy identifier representing the first control strategy based on the first bit value and the second bit value.

[0128] In some embodiments, the authentication result may also include information related to a second control policy corresponding to the target source MAC address; The identifier determination module 602 is used to determine a first strategy identifier that represents the first control strategy and the second control strategy based on information related to the first control strategy and information related to the second control strategy.

[0129] In some implementations of this embodiment, the first control strategy is a strategy that needs to be distinguished by a number. The information related to the first control strategy includes the strategy type of the first control strategy and the number of the first control strategy. The second control strategy is a strategy that does not need to be distinguished by a number. Information related to the second control strategy includes the strategy type of the second control strategy. The identifier determination module 602 is used to determine a first bit value based on the strategy type of the first control strategy and the strategy type of the second control strategy; determine a second bit value based on the number of the first control strategy; and determine a first strategy identifier representing the first control strategy and the second control strategy based on the first feature and the second bit value.

[0130] In some implementations of this embodiment, the storage module 604 is further configured to store, based on the rules in the acquired second control strategy, the table entries formed by combining each rule in the second control strategy with the first strategy identifier into a hardware access control table.

[0131] In some embodiments, the authentication result may also include information related to a second control policy corresponding to the target source MAC address; The identifier determination module 602 is also used to determine a second strategy identifier that represents the second control strategy based on information related to the second control strategy; The association module 603 is also used to associate the second policy identifier with the target source MAC address; The storage module 604 is further configured to, if there is no entry containing the second policy identifier in the hardware access control table, store the entries formed by combining each rule in the second control policy with the second policy identifier into the hardware access control table based on each rule in the acquired second control policy.

[0132] In some embodiments, the device further includes: The instruction acquisition module is used to acquire update instructions for the first control strategy, wherein the update instruction is any one of the rule replacement instruction, rule addition instruction, and rule deletion instruction; The first update module is used to, if the update instruction is a rule replacement instruction, in response to the rule replacement instruction, replace the entry in the hardware access control table formed by the combination of the first rule and the first policy identifier with the entry formed by the combination of the second rule and the first policy identifier based on the first policy identifier representing the first control policy. The second update module is used to, in response to the rule addition instruction, store the entry formed by combining the third rule and the first policy identifier in the hardware access control table into the hardware access control table based on the first policy identifier that represents the first control policy. The third update module is used to delete the entry formed by the combination of the fourth rule and the first policy identifier in the hardware access control table, based on the first policy identifier representing the first control policy, if the update instruction is a rule deletion instruction.

[0133] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0134] Furthermore, regarding the control strategy storage device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the control strategy storage device can be found in [reference needed]. Figure 7 As shown, the control strategy storage device may include: a memory 700 and a processor 710. The memory 700 is used to store program instructions; the processor 710 calls the program instructions stored in the memory 700 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.

[0135] Optionally, this application also provides a distributed communication device, including at least one processing element (or chip) for performing the above method embodiments.

[0136] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the above-described method embodiments.

[0137] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0138] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0139] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0140] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0142] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0144] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for storing control strategies, characterized in that, The method includes: If it is determined that there is no entry in the source MAC address table that matches the target source MAC address of the target packet, then the authentication result for the target source MAC address is obtained, wherein the authentication result includes information related to the first control policy corresponding to the target source MAC address; Based on the information related to the first control strategy, a first strategy identifier representing the first control strategy is determined. Associate the first policy identifier with the target source MAC address; If there is no entry in the hardware access control table that contains the first policy identifier, then based on each rule in the first control policy, the entries formed by combining each rule in the first control policy with the first policy identifier are stored in the hardware access control table.

2. The method as described in claim 1, characterized in that, The relevant information includes the strategy type of the first control strategy, which is a strategy that does not need to be distinguished by a number; The step of determining a first strategy identifier representing the first control strategy based on information related to the first control strategy includes: The first bit value is determined based on the policy type of the first control policy; Based on the first bit value, a first policy identifier representing the first control policy is determined.

3. The method according to claim 2, characterized in that, The first control strategy is a strategy that needs to be distinguished by a number, and the relevant information also includes the number of the first control strategy; The step of determining the first policy identifier representing the first control policy based on the first bit value includes: The second bit value is determined based on the number of the first control strategy; Based on the first bit value and the second bit value, a first policy identifier representing the first control policy is determined.

4. The method as described in claim 1, characterized in that, The authentication result also includes information related to the second control policy corresponding to the target source MAC address; The step of determining a first strategy identifier representing the first control strategy based on information related to the first control strategy includes: Based on the information related to the first control strategy and the information related to the second control strategy, a first strategy identifier representing the first control strategy and the second control strategy is determined.

5. The method as described in claim 4, characterized in that, The first control strategy is a strategy that needs to be distinguished by a number. The information related to the first control strategy includes the strategy type of the first control strategy and the number of the first control strategy. The second control strategy is a strategy that does not need to be distinguished by a number. The information related to the second control strategy includes the strategy type of the second control strategy. The step of determining a first strategy identifier representing the first control strategy and the second control strategy based on information related to the first control strategy and information related to the second control strategy includes: The first bit value is determined based on the policy type of the first control policy and the policy type of the second control policy; The second bit value is determined based on the number of the first control strategy; Based on the first ratio feature and the second bit value, a first strategy identifier representing the first control strategy and the second control strategy is determined.

6. The method as described in claim 4, characterized in that, The method further includes: Based on the rules in the acquired second control policy, the entries formed by combining each rule in the second control policy with the first policy identifier are stored in the hardware access control table.

7. The method according to any one of claims 1 to 3, characterized in that, The authentication result also includes information related to the second control policy corresponding to the target source MAC address; The method further includes: Based on the information related to the second control strategy, a second strategy identifier representing the second control strategy is determined; Associate the second policy identifier with the target source MAC address; If there is no entry in the hardware access control table that contains the second policy identifier, then based on each rule in the obtained second control policy, the entries formed by combining each rule in the second control policy with the second policy identifier are stored in the hardware access control table.

8. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Obtain an update instruction for the first control strategy, wherein the update instruction is any one of a rule replacement instruction, a rule addition instruction, or a rule deletion instruction; If the update instruction is a rule replacement instruction, in response to the rule replacement instruction, based on the first policy identifier representing the first control policy, the table entry formed by the combination of the first rule and the first policy identifier in the hardware access control table is replaced with the table entry formed by the combination of the second rule and the first policy identifier. If the update instruction is a rule addition instruction, in response to the rule addition instruction, based on the first policy identifier that represents the first control policy, the table entry formed by combining the third rule and the first policy identifier in the hardware access control table is stored in the hardware access control table. If the update instruction is a rule deletion instruction, in response to the rule deletion instruction, based on the first policy identifier representing the first control policy, the entry formed by the combination of the fourth rule and the first policy identifier in the hardware access control table is deleted.

9. A control strategy storage device, characterized in that, The device includes: An authentication module is used to obtain an authentication result for the target source MAC address if it is determined that there is no entry in the source MAC address table that matches the target source MAC address of the target packet. The authentication result includes information related to a first control policy corresponding to the target source MAC address. The identifier determination module is used to determine a first strategy identifier that represents the first control strategy based on information related to the first control strategy. The association module is used to associate the first policy identifier with the target source MAC address; The storage module is configured to, if there is no entry in the hardware access control table that contains the first policy identifier, store the entries formed by combining each rule in the first control policy with the first policy identifier into the hardware access control table based on each rule in the acquired first control policy.

10. A network device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the method of any one of claims 1-8 according to the obtained program instructions.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-8.

Images