Traffic policy determination method, electronic device, and storage medium

Abstract

The present application discloses a traffic policy determination method, an electronic device, and a storage medium. The method is applied to a policy execution node and comprises: acquiring first information, wherein the first information corresponds to a first packet from a gateway, and the first information indicates a first correspondence between an Internet protocol version 6 (IPv6) address of a terminal and a media access control (MAC) address of the terminal; acquiring a first mapping relationship, wherein the first mapping relationship indicates a relationship among an Internet protocol version 4 (IPv4) address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and on the basis of the first information and the first mapping relationship, determining a traffic policy corresponding to the IPv6 address of the terminal.

Description

Traffic strategy determination method, electronic device, and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 7, 2023, with application number 202311149908.4 and invention name “A strategic accompanying method, device and electronic device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a method for determining a traffic strategy, an electronic device, and a storage medium. Background Art

[0004] Within campus networks, network administrators need to centrally manage user network access permissions, requiring users to access network segments and locations according to pre-planned protocols. As enterprise networks continue to grow and develop, user access locations can move widely, requiring network administrators to reassign network access permissions, significantly inconvenient for network management and maintenance.

[0005] Therefore, to address these issues, we've developed an effective method for network management and enterprise network security called policy mobility. Policy mobility ensures a consistent user experience regardless of where users move. This breaks the limitations of traditional network access locations and truly embodies the principle of the network following the user.

[0006] Summary of the Invention

[0007] The present application provides a traffic strategy determination method, an electronic device, and a storage medium.

[0008] In the first aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a policy execution node, and the method includes: obtaining first information, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an Internet Protocol version 6 IPv6 address of a terminal and a media access control MAC address of the terminal; obtaining a first mapping relationship, wherein the first mapping relationship indicates a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal; and determining the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

[0009] In one possible design, the traffic policy corresponding to the IPv6 address of the terminal is determined based on the first information and the first mapping relationship, including: determining the traffic policy corresponding to the IPv6 address of the terminal based on the traffic policy corresponding to the IPv4 address of the terminal; wherein the traffic policy corresponding to the IPv6 address of the terminal is the same as the traffic policy corresponding to the IPv4 address of the terminal.

[0010] In one possible design, obtaining the first mapping relationship includes: obtaining the first mapping relationship from the controller through a network configuration protocol NETCONF interface.

[0011] In one possible design, obtaining the first mapping relationship includes: obtaining second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; obtaining third information, wherein the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal; and obtaining the first mapping relationship based on the second information and the third information.

[0012] In one possible design, obtaining the second information includes: obtaining the second information from the gateway through an Ethernet-based virtual private network EVPN; wherein, the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the second message is one of the following messages: an Address Resolution Protocol ARP message, an ARP table entry, a Dynamic Host Configuration Protocol DHCP Snooping message, or a DHCP Snooping table entry.

[0013] In one possible design, obtaining the second information includes: obtaining the second information from the controller through the network configuration protocol NETCONF interface; wherein the second message is an ARP message or an ARP table entry.

[0014] In one possible design, obtaining the second information includes: directly obtaining the second information from the gateway, wherein the policy execution node is set on the gateway, and the second message is an ARP message or an ARP table entry.

[0015] In one possible design, obtaining the first information includes: obtaining the first information from the gateway through an Ethernet-based virtual private network EVPN; wherein, the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message, or an ND Snooping table entry.

[0016] In one possible design, obtaining the first information includes: obtaining the first information from the controller through the network configuration protocol NETCONF interface; wherein, the first message is an ND message or an ND table entry.

[0017] In one possible design, obtaining the first information includes: directly obtaining the first information from the gateway, wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

[0018] In a second aspect, a method for determining a traffic policy is provided, wherein the method is applied to a gateway, and the method includes: sending a first message, wherein the first message allows a policy execution node to determine the traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

[0019] In one possible design, sending the first message includes: sending the first message through an Ethernet-based virtual private network EVPN; wherein, the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message, or an ND Snooping table entry.

[0020] In one possible design, sending the first message includes: sending the first message to the controller through the remote procedure call protocol GRPC interface or the NETCONF interface to allow the controller to send the first message to the policy execution node; wherein, the first message is a neighbor discovery ND message or an ND table entry.

[0021] In one possible design, sending the first message includes: directly sending the first message to the policy execution node; wherein, the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

[0022] In one possible design, before sending the first message and the second message, the method also includes: learning the first message and the second message from the terminal.

[0023] In a third aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a controller, and the method includes: receiving a first message sent by a gateway; and sending the first message to a policy execution node, wherein the first message allows the policy execution node to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship; wherein the first information corresponds to a first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

[0024] In one possible design, the method further includes: sending the first mapping relationship to the policy execution node through a network configuration protocol NETCONF interface.

[0025] In one possible design, the method also includes: receiving a second message sent by the gateway; sending second information and third information to the policy execution node; wherein the second information and the third information allow the policy execution node to determine the first mapping relationship; the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; and the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal.

[0026] In a fourth aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a policy execution node, and the method includes: receiving fourth information, wherein the fourth information indicates the traffic policy corresponding to the IPv6 address of the terminal; the fourth information is determined based on the first information and the first mapping relationship, the first information corresponds to the first message from the gateway, and the first information indicates the first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; the first mapping relationship indicates the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal; and based on the fourth information, determining the traffic policy corresponding to the IPv6 address of the terminal.

[0027] In a fifth aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a gateway, and the method includes: sending a first message, wherein the first message allows the controller to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship, and send the traffic policy corresponding to the IPv6 address of the terminal to the policy execution node; wherein the first information corresponds to a first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

[0028] In a sixth aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a controller, and the method includes: receiving a first message sent by a gateway; the first message allows the controller to determine fourth information based on the first information and the first mapping relationship; wherein the first information corresponds to a first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal; the fourth information indicates the traffic policy corresponding to the IPv6 address of the terminal; and sending the fourth information to the policy execution node.

[0029] In a seventh aspect, the present application provides a traffic policy determination device, wherein the device includes: an acquisition module, configured to obtain first information and a first mapping relationship, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an IPv6 address of a terminal and a MAC address of the terminal; the first mapping relationship indicates a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal; and

[0030] A traffic policy determination module is used to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

[0031] In an eighth aspect, the present application provides a policy accompanying method, which is applied to a software-defined network (SDN), and the method includes:

[0032] In response to a user operation selecting a target identification mode, obtaining a first mapping relationship and a message of a terminal, wherein the first mapping relationship represents a relationship between MAC address information, IPv4 address information, and a user group of the terminal;

[0033] Generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group;

[0034] Determine a traffic policy for the IPv6 address information based on the second mapping relationship.

[0035] Through the above method, a second mapping relationship between IPv6 address information and user groups is generated, and a traffic policy of the IPv6 address information is determined according to the second mapping relationship, thereby realizing policy-based mobility of terminal IPv6 service traffic.

[0036] In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network (EVPN) identification mode, and a local gateway identification mode.

[0037] In one possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0038] In response to a user operation selecting the controller identification mode, acquiring, based on the controller in the SDN, a first mapping relationship of the terminal and the message;

[0039] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

[0040] Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0041] Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0042] Through the above method, in response to the user operation of selecting the controller identification mode, a second mapping relationship between the IPv6 address information and the user group is generated based on the controller, and the second mapping relationship is sent to the policy execution node, thereby realizing policy-based mobility of the terminal IPv6 service traffic without relying on the authentication device to report the IPv6 address information.

[0043] In one possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0044] In response to a user operation selecting the local EVPN identification mode, obtaining a first mapping relationship of the terminal based on a controller in the SDN, and obtaining a message of the terminal based on a policy execution node in the SDN;

[0045] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

[0046] The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0047] The policy execution node compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0048] Through the above method, in response to a user operation selecting the local EVPN identification mode, a second mapping relationship between IPv6 address information and user groups is generated based on the policy execution node, thereby eliminating the need for the controller to separately deliver a traffic policy for IPv6 address information, thereby improving the performance of policy delivery.

[0049] In one possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

[0050] In response to a user operation selecting the local gateway identification mode, obtaining a first mapping relationship of the terminal based on a controller in the SDN, and obtaining a message of the terminal based on a gateway in the SDN;

[0051] The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

[0052] Sending the first mapping relationship to the gateway based on the controller, and parsing the message based on the gateway to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0053] The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0054] Through the above method, in response to the user operation of selecting the local gateway identification mode, the second mapping relationship between the IPv6 address information and the user group can be directly generated based on the gateway.

[0055] In a ninth aspect, the present application provides a policy accompanying device, which is applied to a software-defined network (SDN), and includes:

[0056] an acquisition module, configured to acquire, in response to a user operation selecting a target recognition mode, a first mapping relationship and a message of a terminal, wherein the first mapping relationship represents a relationship between the MAC address information, the IPv4 address information, and the user group of the terminal;

[0057] a generating module, configured to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

[0058] A policy accompanying module is used to determine the traffic policy of the IPv6 address information based on the second mapping relationship.

[0059] In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network (EVPN) identification mode, and a local gateway identification mode.

[0060] In one possible design, the acquisition module is specifically configured to:

[0061] In response to a user operation selecting the controller identification mode, acquiring, based on the controller in the SDN, a first mapping relationship of the terminal and the message;

[0062] The generation module is specifically used for:

[0063] Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0064] Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0065] In one possible design, the acquisition module is further configured to:

[0066] In response to a user operation selecting the local EVPN identification mode, obtaining a first mapping relationship of the terminal based on a controller in the SDN, and obtaining a message of the terminal based on a policy execution node in the SDN;

[0067] The generation module is further configured to:

[0068] The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0069] The policy execution node compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0070] In one possible design, the acquisition module is further configured to:

[0071] In response to a user operation selecting the local gateway identification mode, obtaining a first mapping relationship of the terminal based on a controller in the SDN, and obtaining a message of the terminal based on a gateway in the SDN;

[0072] The generation module is further configured to:

[0073] Sending the first mapping relationship to the gateway based on the controller, and parsing the message based on the gateway to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

[0074] The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

[0075] In a tenth aspect, the present application provides an electronic device, comprising:

[0076] Memory for storing computer programs;

[0077] The processor is configured to implement the above-mentioned traffic policy determination method steps or policy following method steps when executing the computer program stored in the memory.

[0078] In the eleventh aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned traffic policy determination method or the steps of the policy following method are implemented.

[0079] In the twelfth aspect, the present application provides a computer program product, which includes: computer program code (or instructions). When the computer program code is executed by one or more processors, the device including the processor executes the above-mentioned traffic policy determination method steps or policy following method steps.

[0080] In an embodiment of the present application, a first message is obtained from a gateway, first information is determined based on the first message, a first correspondence between the terminal's IPv6 address and the terminal's MAC address is determined, and a traffic policy corresponding to the terminal's IPv6 address is determined based on the first information and the first mapping relationship. In this embodiment, there is no need for the authentication device to support IPv6 authentication and audit functions, nor is there a need to set a private message in the authentication message to carry IPv6-related information. This decouples the process of determining the traffic policy for the terminal's IPv6 address information from the authentication device, thereby reducing the burden on the authentication device.

[0081] The technical effects that can be achieved in each of the above-mentioned aspects from the second to the twelfth aspects and each of the aspects can be referred to the technical effects that can be achieved in the above-mentioned first aspect or various possible solutions in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for the description of the embodiments or traditional technologies. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, drawings of other embodiments can be obtained based on these drawings without creative work. The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application.

[0083] FIG1 is a flow chart of a method for determining a traffic strategy provided in an embodiment of the present application.

[0084] FIG2 is a schematic diagram of signaling interaction in a controller identification mode provided in an embodiment of the present application.

[0085] FIG3 is a schematic diagram of signaling interaction in a local EVPN identification mode provided in an embodiment of the present application.

[0086] FIG4 is a schematic diagram of signaling interaction in a local gateway identification mode provided in an embodiment of the present application.

[0087] FIG5 is a flow chart of a method for determining a traffic strategy provided in an embodiment of the present application.

[0088] FIG6 is a schematic structural diagram of a traffic strategy determination device provided in an embodiment of the present application.

[0089] FIG7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0090] FIG8 is a schematic structural diagram of a traffic strategy determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0091] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist, and B exists alone. A is connected to B, which can represent the following two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0092] In order to facilitate understanding by those skilled in the art, the technical terms involved in the embodiments of the present application are first explained.

[0093] (1) Software Defined Network (SDN) is a network virtualization implementation that separates the control plane and data plane of network devices, with a unified open interface between the control plane and the data plane. The controller is the brain of SDN, providing different levels of programmability to upper-layer network applications through northbound interfaces and uniformly configuring, managing, and controlling the data plane through southbound interfaces.

[0094] (2) Lightweight Directory Access Protocol (LDAP) is a protocol for accessing online directory services. LDAP servers provide global directory services for sharing component information (e.g., server names and connection properties).

[0095] (3) Office Automation (OA) is a new way of working that combines modern office work with computer technology. OA servers are cloud servers used to host various OA office software.

[0096] (4) Ethernet Virtual Private Network (EVPN) is a VPN technology used for Layer 2 network interconnection. EVPN extends the BGP protocol to transfer the learning and publishing process of MAC address information between Layer 2 networks from the data plane to the control plane.

[0097] (5) An autonomous system (AS) is a group of routers managed by the same technical management organization and running the same dynamic routing protocol.

[0098] (6) Border Gateway Protocol (BGP) is an AS-based protocol. BGP neighbor relationships are manually configured to enable two parties running BGP to find each other and establish connections.

[0099] (7) Remote Authentic Dial In User Service (RADIUS) is used to authenticate and bill dial-up users.

[0100] (8) Address Resolution Protocol (APR) is a protocol that obtains MAC address information based on IP address information.

[0101] (9) The Neighbor Discovery Protocol (ND) is responsible for discovering the corresponding address information of other nodes on a link, determining available routes, and maintaining information about available paths and other active nodes. ND defines five types of messages.

[0102] Neighbor Solicitation (NS): An IPv6 node (a terminal using the IPv6 protocol) uses an NS message to obtain the link-layer address information of its neighbor and check whether the neighbor is reachable.

[0103] Neighbor Advertisement (NA) message: The NA message is the response of the IPv6 node to the NS message.

[0104] Router Solicitation (RS) messages: After an IPv6 node starts up, it sends RS messages to the router to request a network prefix and other configuration information for automatic configuration of IPv6 node address information.

[0105] Router Advertisement (RA) messages: Routers periodically publish RA messages, which include key network configuration information such as network prefixes, or respond to RS messages with RA messages.

[0106] Redirect message: When the router finds that the incoming interface and outgoing interface of the message are the same, it can notify the terminal through the redirect message to select another better next hop address information for sending subsequent messages.

[0107] (10) Network Configuration Protocol (NETCONF) is a network management protocol based on Extensible Markup Language (XML). It provides a programmable method for the controller to configure and manage the gateway and obtain the gateway's data.

[0108] (11) Remote Procedure Call Protocol (RPC) is a protocol that requests services from remote computer programs over the network without requiring knowledge of the underlying network technology. In other words, a controller can remotely call gateway data through RPC. GRPC refers to the RPC framework developed by Google.

[0109] (12) Telemetry technology is a comprehensive technology that uses sensing technology, communication technology and data processing technology to transmit the short-range measurement values ​​of object parameters to a distant measurement station to achieve long-distance measurement.

[0110] (13) Type 2 routing, also known as MAC / IP routing, is used to advertise MAC and IP address information.

[0111] (14) A host table is a mapping table used in computer networks to associate IP address information with corresponding host names.

[0112] (15) The southbound interface is the communication protocol between the controller and the switch (gateway, policy execution node, terminal).

[0113] Strategy mobility means that no matter where the user moves, the user experience remains unchanged. It breaks the limitations of traditional networks on access location and truly embodies the characteristic of the network following the user.

[0114] Traditional policy mobility solutions are primarily used in Internet Protocol version 4 (IPv4) networks. They implement policy mobility for terminal IPv4 service traffic by obtaining the relationship between terminal IPv4 address information and user groups and then sending this information to policy execution nodes.

[0115] However, with the advent of Internet Protocol version 6 (IPv6), how to determine the traffic strategy for terminal IPv6 services has become an urgent problem to be solved.

[0116] The embodiments of the present application provide a method for determining a traffic policy, which can implement policy-based mobility for terminal IPv6 service traffic by generating a second mapping relationship between IPv6 address information and user groups and determining a traffic policy for the IPv6 address information based on the second mapping relationship. The method and apparatus described in the embodiments of the present application are based on the same technical concept. Since the principles of the problems solved by the method and apparatus are similar, the embodiments of the apparatus and method can refer to each other, and the repeated parts will not be repeated.

[0117] To further illustrate the technical solutions provided by the embodiments of the present application, this is described in detail below with reference to the accompanying drawings and specific implementation methods. Although the embodiments of the present application provide the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiments of the present application. The method may be executed or executed in parallel in the order of the methods shown in the embodiments or drawings during the actual processing process or when the device is executed.

[0118] Figure 1 is a flow chart of a traffic policy determination method provided in an embodiment of the present application. This method is applied to a traffic policy determination system. The process can be executed by a policy accompanying device, which can be implemented in software, hardware, or a combination of software and hardware to ensure the normal operation of the system. As shown in Figure 1, the process includes the following steps.

[0119] S11 , in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of a terminal.

[0120] S12: Generate a second mapping relationship between the IPv6 address information of the terminal and the user group based on the first mapping relationship and the message.

[0121] S13: Determine a traffic policy for the IPv6 address information according to the second mapping relationship.

[0122] In the implementation manner of the present application, the traffic policy of the IPv6 address of the same terminal may be the same as the traffic policy of the IPv4 address of the terminal, which will not be described in detail below.

[0123] A user group is a collection of multiple user devices. Traffic policies can be set for user groups through the controller to ensure that network resources are not illegally used or accessed. Traffic policies are access control policies. Traffic policies can be either allow or deny, or they can be full access, partial access, speed-limited access, or time-limited access. Those skilled in the art should be aware of the various types of traffic policies, which will not be described in detail in this article. Each user group can correspond to a traffic policy. When the policy execution node determines the user group corresponding to the terminal IPv4 address or IPv6 address, it can determine the traffic policy corresponding to the terminal IPv4 address or IPv6 address. When the terminal devices in the user group access the network at any location, the access control policy of the user devices is the same, thus realizing business mobility.

[0124] The user operation of selecting the target identification mode may refer to determining the traffic policy determination method of the device through device configuration according to requirements during the device deployment stage or the operation stage.

[0125] In the embodiment of the present application, when configuring the network, the SDN controller will obtain the organizational relationship (user group) within the organization from the LDAP, OA and other servers, and send the user group and its corresponding traffic policy to the policy execution node. For the sake of convenience, the term "controller" will be used to refer to the SDN controller.

[0126] In addition, for devices that do not have corresponding specific user groups in the organizational relationship, such as printers or monitoring devices, they can also be individually set up as user groups corresponding to one or more user groups (for example, shared user groups), and the user groups corresponding to these devices and the traffic policies corresponding to the user groups can be sent to the policy execution node.

[0127] The policy execution node is used to store the IP address of the terminal device and the corresponding traffic policy. In one embodiment, the policy execution node may store the IP address of the terminal device and the corresponding user group information, where the user group information corresponds to the traffic policy. When the policy execution node receives a message from the terminal device, it queries the source IP address of the message and the user group information to which it belongs, and executes the traffic policy corresponding to the user group. When the policy execution node receives a message sent to the terminal device, it queries the destination IP address of the message and the user group information to which it belongs, and executes the traffic policy corresponding to the user group.

[0128] Optionally, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network (EVPN) identification mode, and a local gateway identification mode.

[0129] In some possible implementations, the controller identification mode is used when the gateway is not configured as a policy execution node and no Border Gateway Protocol (BGP) neighbor relationship is configured between the gateway and the policy execution node. Figure 2 shows a schematic diagram of signaling interaction for a controller identification mode according to an embodiment of the present application, including obtaining a first mapping relationship for a terminal based on the controller, where the first mapping relationship represents the relationship between the terminal's MAC address information, IPv4 address information, and user group.

[0130] A specific method for obtaining the first mapping relationship may be: the terminal initiates an authentication request to the authentication device, and after receiving the authentication request, the authentication device sends the authentication request and billing message to the controller via RADIUS. After receiving the authentication request and billing message, the controller performs proxy authentication, for example, sending the authentication request to the authentication server. After the authentication is successful, the authentication server returns the authentication pass information to the controller, so that the controller returns the authentication pass information to the terminal via the authentication device. At this point, the terminal authentication is successful. Under the control of the administrator, the controller can bind the IPv4 address information, MAC address information, and user identity information of the terminal carried in the billing message, determine the user group to which the user belongs based on the user identity information, and generate the first mapping relationship between the terminal's MAC address information, IPv4 address information, and user group.

[0131] In some embodiments, the controller obtains a message corresponding to the terminal, such as an ARP message and an ND message, wherein the ARP message includes the correspondence between the terminal's MAC address and the terminal's IPv4 address, and the ND message includes the correspondence between the terminal's MAC address and the terminal's IPv6 address. In the exemplary embodiments of the present application, messages are used as examples for explanation. Those skilled in the art will appreciate that the message corresponding to the terminal can also be replaced with a table item corresponding to the terminal, such as an ARP table item and an ND table item, wherein the ARP table item includes the correspondence between the terminal's MAC address and the terminal's IPv4 address, and the ND table item includes the correspondence between the terminal's MAC address and the terminal's IPv6 address. Generally speaking, a message contains more data information, and the table item is information extracted from the message. If the table item is used to transmit the correspondence between the IP address and the MAC address, the transmission efficiency can be improved.

[0132] Specifically, the gateway learns the terminal's message or table entry and sends the message or table entry to the controller, for example, through NETCONF, GRPC or telemetry technology.

[0133] In some embodiments, after receiving the message or table entry, the controller parses the message or table entry to obtain a third mapping relationship between the terminal's MAC address information and the IPv6 address information, and based on the third mapping relationship and the first mapping relationship, generates a second mapping relationship between the IPv6 address information and the above-mentioned user group.

[0134] The controller can send the second mapping relationship to the policy execution node via, for example, the network configuration protocol NETCONF, so that the policy execution node determines a traffic policy for the IPv6 address information based on the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion for policy association. Simultaneously, the policy execution node also installs the second mapping relationship into the host table.

[0135] In some implementations, after receiving the message or entry, the controller may send the message or entry to the policy execution node, which parses the message or entry to obtain a third mapping relationship between the terminal's MAC address information and the IPv6 address information.

[0136] The policy execution node obtains a first mapping relationship from the controller, where the first mapping relationship includes a mapping relationship between MAC address information of the terminal, IPv4 address information, and a user group.

[0137] The policy execution node generates a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determines a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

[0138] In some implementations, after receiving the message or entry, the controller may send the message or entry to the policy execution node, which parses the message or entry to obtain a third mapping relationship between the terminal's MAC address information and the IPv6 address information.

[0139] Additionally or alternatively, when issuing a traffic policy corresponding to an IPv4 address, the controller may send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node may obtain the correspondence between the IPv4 address and the terminal's MAC address based on an ARP message or an ARP table entry, and then obtain the first mapping relationship based on the traffic policy corresponding to the IPv4 address.

[0140] The policy execution node may generate a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determine a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

[0141] Through the above method, the above message is sent to the controller based on the gateway. There is no need for the authentication device to support IPv6 authentication and audit functions, nor is there any need to set a private message in the authentication message to carry IPv6-related information. This decouples the traffic policy determination process of the terminal's IPv6 address information from the authentication device, thereby reducing the burden on the authentication device.

[0142] In some possible implementations, the local EVPN identification mode is used in scenarios where the gateway is not configured as a policy enforcement node and a BGP neighbor relationship is configured between the gateway and the policy enforcement node. FIG3 shows a schematic diagram of signaling interactions in the local EVPN identification mode provided in an embodiment of the present application.

[0143] The policy execution node obtains messages or entries corresponding to the terminal, such as ARP messages or entries, and ND messages or entries. In some embodiments, the messages or entries corresponding to the terminal obtained by the policy execution node may also be Dynamic Host Configuration Protocol snooping DHCP snooping messages or entries, and Neighbor Discovery snooping ND snooping messages or entries.

[0144] Specifically, the gateway learns the terminal's message and sends the message to the policy execution node through BGP. For example, the gateway sends the message to the policy execution node through EVPN Type 2 routing.

[0145] When receiving the message, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0146] The controller obtains the first mapping relationship of the terminal, wherein the specific method of obtaining the first mapping relationship is consistent with the method of obtaining the first mapping relationship in the controller identification mode and is not repeated here. The controller then sends the first mapping relationship to the policy execution node through the southbound interface.

[0147] When the policy execution node receives the first mapping relationship, it generates a second mapping relationship between the terminal's IPv6 address information and the user group based on the first mapping relationship and the above-mentioned third mapping relationship; determines the traffic policy of the IPv6 address information according to the second mapping relationship; and installs the second mapping relationship into the host table.

[0148] The policy execution node determines the traffic policy for the IPv6 address information based on the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion for policy association. At the same time, the policy execution node also installs the second mapping relationship into the host table.

[0149] In some implementations, upon receiving an ND message or an ND entry, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0150] Additionally or alternatively, when issuing a traffic policy corresponding to an IPv4 address, the controller may send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node may obtain the correspondence between the IPv4 address and the terminal's MAC address based on an ARP message or an ARP table entry, and then obtain the first mapping relationship based on the traffic policy corresponding to the IPv4 address.

[0151] The policy execution node may generate a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determine a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

[0152] The above method synchronizes these messages over EVPN, utilizing existing protocols without the need for a new proprietary protocol to transmit the binding relationship between IPv6 address information and MAC address information. This reduces performance overhead at the policy execution node. Furthermore, the policy execution node maps and associates IPv6 address information with user groups, determining the traffic policy for IPv6 addresses based on the traffic policy for IPv4 addresses. This eliminates the need for controller-based traffic policy determination, avoids centralized controller management, reduces the controller's burden, and improves reliability. Furthermore, in this solution, the authentication device is not required to transmit IPv6 address information to the controller in real time via billing messages. This reduces interaction between the authentication device and the controller, alleviating the burden on both devices.

[0153] In some implementations, the local gateway identification mode is used in a scenario where the gateway is configured as a policy execution node. FIG4 is a schematic diagram of signaling interaction in a local gateway identification mode provided by an embodiment of the present application.

[0154] The controller obtains the first mapping relationship of the terminal. The specific method for obtaining the first mapping relationship is the same as that in the controller identification mode and is not repeated here. The controller then sends the first mapping relationship to the policy execution node, i.e., the gateway, via the southbound interface.

[0155] At the same time, based on the gateway learning the terminal's message or table entry, such as the ARP message or table entry and the ND message or table entry, the gateway can obtain the third mapping relationship between the terminal's MAC address information and IPv6 address information by parsing the message or table entry.

[0156] Furthermore, based on the third mapping relationship and the first mapping relationship, the gateway generates a second mapping relationship between the IPv6 address information and the user group. The gateway then determines a traffic policy for the IPv6 address information based on the second mapping relationship. For example, the gateway notifies the second mapping relationship to the solution application component of the policy companion for policy association. Simultaneously, the gateway also installs the second mapping relationship into the host table.

[0157] In some implementations, upon receiving an ND message or an ND entry, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0158] Additionally or alternatively, when issuing a traffic policy corresponding to an IPv4 address, the controller may send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node obtains the correspondence between the IPv4 address and the terminal's MAC address based on the received ARP message or ARP table entry, and then obtains the first mapping relationship based on the traffic policy corresponding to the IPv4 address.

[0159] The policy execution node generates a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determines a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

[0160] Through the above method, when the gateway is configured as a policy execution node, there is no need to send messages or table entries to the controller. The terminal's IPv6 address information is directly associated with the user group based on the gateway, realizing policy-based mobility of the terminal's IPv6 service traffic.

[0161] FIG5 is a flow chart of a method for determining a traffic policy according to an embodiment of the present application. The method is applied to a policy execution point. As shown in FIG5 , the process includes the following steps.

[0162] S51. Obtain first information, where the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an IPv6 address of a terminal and a MAC address of the terminal.

[0163] S52: Obtain a first mapping relationship, wherein the first mapping relationship indicates a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal.

[0164] S53: Determine a traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

[0165] In this embodiment, a first message is obtained from a gateway, first information is determined based on the first message, a first correspondence between the terminal's IPv6 address and the terminal's MAC address is determined, and a traffic policy corresponding to the terminal's IPv6 address is determined based on the first information and the first mapping relationship. In this embodiment, there is no need for the authentication device to support IPv6 authentication and audit functions, nor is there a need to include a private message in the authentication message to carry IPv6-related information. This decouples the process of determining the traffic policy for the terminal's IPv6 address information from the authentication device, thereby reducing the burden on the authentication device.

[0166] In some embodiments, the policy execution node obtains a first mapping relationship from the controller, wherein the first mapping relationship is a mapping relationship between the terminal's IPv4 address, the MAC address, and the traffic policy corresponding to the terminal's IPv4 address. The policy execution node determines the traffic policy corresponding to the terminal's IPv4 address based on the first mapping relationship, and determines the traffic policy corresponding to the terminal's IPv6 address based on the first mapping relationship and the traffic policy corresponding to the terminal's IPv4 address.

[0167] In some embodiments, the policy execution node obtains second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal. The policy execution node also obtains third information from the controller, wherein the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal. Based on the second and third information, the policy execution node obtains the first mapping relationship.

[0168] It should be noted that in the above embodiments, there is no restriction on the number of policy execution nodes and terminals. Terminals include, but are not limited to, mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices used in industrial control, wireless terminal devices used in unmanned driving, wireless terminal devices used in smart grids, wireless terminal devices used in transportation safety, wireless terminal devices used in smart cities, or wireless terminal devices used in smart homes.

[0169] Based on the same inventive concept, an embodiment of the present application further provides a traffic policy determination device, as shown in Figure 6, which is a schematic diagram of the structure of a traffic policy determination device provided in an embodiment of the present application. The traffic policy determination device can be a policy execution node.

[0170] The device includes: an acquisition module 51, which is used to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents the relationship between the MAC address information, IPv4 address information and user group of the terminal.

[0171] The generating module 52 is configured to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message.

[0172] The traffic policy determining module 53 is configured to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

[0173] In a possible implementation manner, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network (EVPN) identification mode, and a local gateway identification mode.

[0174] In a possible design, the acquisition module 51 is specifically used to: in response to a user operation of selecting the controller identification mode, acquire the first mapping relationship of the terminal and the message based on the controller.

[0175] The generating module 52 is specifically configured to: parse the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0176] The controller generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship, so that the policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship.

[0177] In one possible design, the acquisition module 51 is further used to: in response to a user operation of selecting the local EVPN identification mode, obtain the first mapping relationship of the terminal based on the controller, and obtain the message of the terminal based on the policy execution node.

[0178] The generating module 52 is further configured to: send the first mapping relationship to the policy execution node based on the controller, and parse the message based on the policy execution node to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0179] The policy execution node generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship.

[0180] In a possible implementation, the acquisition module 51 is further configured to: in response to a user operation selecting the local gateway identification mode, acquire the first mapping relationship of the terminal based on the controller, and acquire the message of the terminal based on the gateway.

[0181] The generating module 52 is further configured to: send the first mapping relationship to the gateway based on the controller, and parse the message based on the gateway to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

[0182] The gateway generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship.

[0183] The above-mentioned traffic policy determination device generates a second mapping relationship between IPv6 address information and user groups, and determines the traffic policy of IPv6 address information according to the second mapping relationship, thereby realizing policy-based mobility of terminal IPv6 service traffic.

[0184] 8, which is a schematic diagram of the structure of a traffic policy determination device provided in an embodiment of the present application. The traffic policy determination device may be a policy execution node.

[0185] The device includes: an acquisition module 71, used to obtain first information and a first mapping relationship, wherein the first information corresponds to a first message from a gateway, the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship indicates the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

[0186] The traffic policy determination module 72 is used to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

[0187] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, which can realize the functions of the aforementioned traffic policy determination device. Referring to Figure 7, the electronic device includes: at least one processor 61, and a memory 62 connected to at least one processor 61. The specific connection medium between the processor 61 and the memory 62 is not limited in the embodiment of the present application. Figure 7 takes the connection between the processor 61 and the memory 62 through the bus 60 as an example. The bus 60 is represented by a thick line in Figure 7, and the connection method between other components is only for schematic illustration and is not intended to be limiting. The bus 60 can be divided into an address information bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in Figure 7, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 61 can also be called a controller, and there is no restriction on the name.

[0188] In the embodiment of the present application, memory 62 stores instructions executable by at least one processor 61. At least one processor 61 can execute the traffic policy determination method discussed above by executing the instructions stored in memory 62. Processor 61 can implement the functions of each module in the apparatus shown in Figures 6 and 8.

[0189] Among them, the processor 61 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 62 and calling data stored in the memory 62, the various functions of the device and processing data.

[0190] In one possible design, processor 61 may include one or more processing units. Processor 61 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 61. In some embodiments, processor 61 and memory 62 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0191] The processor 61 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the traffic policy determination method disclosed in the embodiments of this application can be directly implemented as a hardware processor, or can be implemented using a combination of hardware and software modules in the processor.

[0192] The memory 62 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. The memory 62 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (RAM), a static random access memory (SRAM), a programmable read-only memory (PROM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic memory, a magnetic disk, an optical disk, etc. The memory 62 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 62 in the embodiment of the present application may also be a circuit or any other device that can implement a storage function to store program instructions and / or data.

[0193] By designing and programming the processor 61, the code corresponding to the traffic policy determination method described in the aforementioned embodiments can be embedded in the chip, thereby enabling the chip to execute the steps of the traffic policy determination method of the embodiments shown in Figures 1 and 5 during operation. Designing and programming the processor 61 is well known to those skilled in the art and will not be described in detail here.

[0194] Based on the same inventive concept, an embodiment of the present application further provides a storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer executes the traffic policy determination method discussed above.

[0195] In some possible implementations, various aspects of the traffic policy determination method provided in the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps of the traffic policy determination method according to various exemplary embodiments of the present application described above in this specification.

[0196] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0197] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0198] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0200] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for determining a traffic strategy, wherein: The method is applied to a policy execution node, and the method comprises: Acquire first information, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an Internet Protocol version 6 IPv6 address of a terminal and a media access control MAC address of the terminal; Acquire a first mapping relationship, wherein the first mapping relationship indicates a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and Based on the first information and the first mapping relationship, determine the traffic policy corresponding to the IPv6 address of the terminal.

2. The method according to claim 1, wherein: The determining, based on the first information and the first mapping relationship, a traffic policy corresponding to the IPv6 address of the terminal includes: Based on the traffic policy corresponding to the IPv4 address of the terminal, determine the traffic policy corresponding to the IPv6 address of the terminal; wherein the traffic policy corresponding to the IPv6 address of the terminal is the same as the traffic policy corresponding to the IPv4 address of the terminal.

3. The method according to claim 1 or 2, wherein: The obtaining of the first mapping relationship includes: The first mapping relationship is obtained from the controller through a network configuration protocol NETCONF interface.

4. The method according to claim 1 or 2, wherein: The obtaining of the first mapping relationship includes: Acquire second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; Acquire third information, wherein the third information indicates a correspondence between the IPv4 address of the terminal and a traffic policy corresponding to the IPv4 address of the terminal; and The first mapping relationship is acquired based on the second information and the third information.

5. The method according to claim 4, wherein: The obtaining of the second information includes: The second information is obtained from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the second message is one of the following messages: an Address Resolution Protocol ARP message, an ARP table entry, a Dynamic Host Configuration Protocol DHCP Snooping message or a DHCP Snooping table entry.

6. The method according to claim 4, wherein: The obtaining of the second information includes: The second information is obtained from the controller through the network configuration protocol NETCONF interface; wherein, The second message is an ARP message or an ARP table entry.

7. The method according to claim 4, wherein: The obtaining of the second information includes: The second information is directly obtained from the gateway, wherein the policy execution node is set on the gateway, and the second message is an ARP message or an ARP table entry.

8. The method according to any one of claims 1 to 7, wherein: The obtaining of the first information includes: The first information is obtained from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message or an ND Snooping table entry.

9. The method according to any one of claims 1 to 7, wherein: The obtaining of the first information includes: The first information is obtained from the controller through a network configuration protocol NETCONF interface; wherein the first message is an ND message or an ND table entry.

10. The method according to any one of claims 1 to 7, wherein: The obtaining of the first information includes: The first information is directly obtained from the gateway, wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

11. A method for determining a traffic strategy, wherein: The method is applied to a gateway, and the method comprises: A first message is sent, wherein the first message allows a policy execution node to determine a traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from a gateway, the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

12. The method according to claim 11, wherein: The sending the first message comprises: A first message is sent through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message or an ND Snooping table entry.

13. The method according to claim 11, wherein: The sending of the first message comprises: The first message is sent to the controller through a remote procedure call protocol GRPC interface or a NETCONF interface to allow the controller to send the first message to the policy execution node; wherein the first message is a neighbor discovery ND message or an ND table entry.

14. The method according to claim 11, wherein: The sending the first message comprises: The first message is directly sent to the policy execution node; wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

15. The method according to any one of claims 11 to 14, wherein: Before sending the first message and the second message, the method further includes: The first message and the second message are learned from the terminal.

16. A method for determining a traffic strategy, wherein: The method is applied to a controller, and the method comprises: receiving a first message sent by the gateway; and The first message is sent to a policy execution node, wherein the first message allows the policy execution node to determine a traffic policy corresponding to the IPv6 address of the terminal based on the first information and a first mapping relationship; wherein the first information corresponds to a first message from a gateway, wherein the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

17. The method according to claim 16, wherein: The method further comprises: The first mapping relationship is sent to the policy execution node through a network configuration protocol NETCONF interface.

18. The method according to claim 16, wherein: The method further comprises: receiving a second message sent by the gateway; Sending second information and third information to the policy execution node; wherein the second information and the third information allow the policy execution node to determine the first mapping relationship; the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; and the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal.

19. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing the method steps of any one of claims 1 to 10 or claims 11 to 15 or claims 16 to 18 when executing the computer program stored in the memory.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 10, claims 11 to 15, or claims 16 to 18 are implemented.

Images