CN116938728A

CN116938728A - Network topology determination method, device and equipment for financial institution network environment

Info

Publication number: CN116938728A
Application number: CN202310828668.4A
Authority: CN
Inventors: 孙源; 李譞; 王立帅; 贾紫倩
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2023-07-07
Filing date: 2023-07-07
Publication date: 2023-10-24

Abstract

The application relates to a network topology determining method, a device, a computer device, a storage medium and a computer program product of a financial institution network environment, which relate to the fields of network technology, information security and financial science and technology. The method comprises the following steps: acquiring a first topological relation among information forwarding devices in a financial institution network environment, and acquiring a second topological relation between a host device and the information forwarding devices; determining a third topological relation between the host device and the virtual device under the condition that the virtual device is operated by the host device; when the host device or the virtual device is provided with a container, acquiring a fourth topological relation of the container through a container daemon; and determining network topology information of the financial institution network environment according to the first topological relation, the second topological relation, the third topological relation and the fourth topological relation. The method can realize the complete grasp of the network topology relationship in the financial institution network environment.

Description

Network topology determination method, device and equipment for financial institution network environment

Technical Field

The present application relates to the field of network technology, information security, and financial science and technology, and in particular, to a method, an apparatus, a computer device, a storage medium, and a computer program product for determining a network topology of a financial institution network environment.

Background

As financial institutions become increasingly digitized, cloud computing and containerization have become widely used, and a large number of financial institutions have begun to transfer business to virtual machines or containers.

However, due to the industry characteristics of the financial institution, part of services, such as inconvenient migration or services with high security requirements, still cannot be migrated to the virtual carrier, but only the original host device can be used as the carrier to operate, so that the coexistence of the host device, the virtual machine and the container exists in the network environment of the financial institution. For some financial institutions, there may be a three-layer nested structure in the network environment where the host device carries a virtual machine in which the containers are run.

However, since the operation and maintenance modes of the host device, the virtual machine, and the container are greatly different, and different personnel are usually responsible for operation and maintenance, and the service carriers such as the virtual machine and the container are often accompanied by frequent migration, and the process of generating and destroying is continuously repeated, it is often difficult for a financial institution adopting a hybrid network environment in which the host device, the virtual machine, and the container coexist, especially a network device with the three-layer nested structure, to completely grasp the network topology relationship in the whole network environment.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a network topology determination method, apparatus, computer device, computer readable storage medium, and computer program product for a financial institution network environment.

In a first aspect, the present application provides a method for determining a network topology of a financial institution network environment. The method comprises the following steps:

acquiring a first topological relation among information forwarding devices in a financial institution network environment and a second topological relation between a host device and the information forwarding devices in the financial institution network environment;

determining a third topological relation between the host device and the virtual device under the condition that the virtual device is operated by the host device;

when the host device or the virtual device is provided with a container, acquiring a fourth topological relation of the container through a container daemon deployed on the host device or the virtual device; the fourth topological relation comprises a topological relation between the container and the host device or a topological relation between the container and the virtual network device;

and determining network topology information of the financial institution network environment according to the first topological relation, the second topological relation, the third topological relation and the fourth topological relation.

In one embodiment, obtaining a second topological relationship between a host device and the information forwarding device in the financial institution network environment includes: when the information forwarding equipment is load balancing equipment, logging in to a configuration information access account provided by the information forwarding equipment; acquiring a load balancing rule between the information forwarding equipment and the corresponding host equipment, which is preconfigured by the information forwarding equipment, through the configuration information access account; and determining a second topological relation between the information forwarding equipment and the corresponding host equipment according to the load balancing rule.

In one embodiment, the acquiring the first topological relation between the information forwarding devices in the financial institution network environment includes: acquiring forwarding rules of each information forwarding device according to a protocol used by each information forwarding device in the financial institution network environment; and determining a first topological relation among the information forwarding devices according to the forwarding rules.

In one embodiment, obtaining a second topological relationship between a host device and the information forwarding device in the financial institution network environment includes: and acquiring a forwarding rule of the host equipment, and determining a second topological relation between the host equipment and the information forwarding equipment according to the forwarding rule.

In one embodiment, the determining, in a case where the host device runs with a virtual device, a third topological relation between the host device and the virtual device includes: and under the condition that the host equipment runs with the virtual equipment, acquiring a third topological relation between the host equipment and the virtual equipment according to bridging network connection and/or network address conversion information in the host equipment.

In one embodiment, the determining, in a case where the host device runs with a virtual device, a third topological relation between the host device and the virtual device includes: and under the condition that the host equipment bears a load balancing function, acquiring a load balancing rule of the host equipment as a third topological relation between the host equipment and the virtual equipment.

In one embodiment, when the host device or the virtual device is provided with a container, the obtaining, by a container daemon corresponding to the container, the fourth topological relation includes: and when the host equipment or the virtual equipment bears a load balancing function, acquiring a load balancing rule between the container acquired by a daemon on the host equipment or the virtual equipment and the host equipment or the virtual equipment as the fourth topological relation.

In one embodiment, the determining the network topology information of the financial institution network environment according to the first topology relationship, the second topology relationship, the third topology relationship and the fourth topology relationship includes: determining physical access links between entity devices in the financial network environment according to the first topological relation and the second topological relation; determining a virtual access link between entity equipment and virtual equipment in the financial network environment according to the third topological relation; determining a container access link between the physical device or the virtual device and the container in the financial network environment according to the fourth topological relation; and constructing a network topology structure diagram of the financial institution network environment as the network topology information according to the physical access link, the virtual access link and the container access link.

In one embodiment, the constructing a network topology structure diagram of the financial institution network environment according to the physical access link, the virtual access link and the container access link, as the network topology information, includes: acquiring hardware load balancing information according to the load balancing rule of the load balancing device, and acquiring virtual load balancing information according to the load balancing rule of the host device or the virtual device carrying the load balancing function; and adding the hardware load balancing information and the virtual load balancing information to the network topology structure diagram.

In a second aspect, the application also provides a network topology determining device of the financial institution network environment. The device comprises:

the system comprises a first topology acquisition module, a second topology acquisition module and a first topology acquisition module, wherein the first topology acquisition module is used for acquiring a first topology relationship among information forwarding devices in a financial institution network environment and a second topology relationship between a host device and the information forwarding devices in the financial institution network environment;

a second topology acquisition module, configured to determine a third topology relationship between the host device and the virtual device when the virtual device is running on the host device;

a third topology acquisition module, configured to acquire, when the host device or the virtual device is provided with a container, a fourth topology relationship of a corresponding container through a container daemon deployed on the host device or the virtual device; the fourth topological relation comprises a topological relation between the container and the host device or a topological relation between the container and the virtual network device;

and the topology summarizing module is used for determining network topology information of the financial institution network environment according to the first topology relationship, the second topology relationship, the third topology relationship and the fourth topology relationship.

In a third aspect, the present application also provides a computer device. The computer device comprises a memory storing a computer program and a processor which when executing the computer program performs the steps of:

In a fourth aspect, the present application also provides a computer-readable storage medium. The computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:

In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the steps of:

The network topology determining method, apparatus, computer device, storage medium and computer program product of the financial institution network environment described above determine network topology information of the financial institution network environment by acquiring a first topology relationship between each information forwarding device, a second topology relationship between a host device and the information forwarding device, a third topology relationship between the host device and a virtual device in the financial institution network environment, and acquiring a fourth topology relationship between a container running on the host device or the virtual device and its host by a container daemon, and determining network topology information of the financial institution network environment in the first topology relationship, the second topology relationship, the third topology relationship and the fourth topology relationship. The method comprises the steps that network links of a traditional environment in a network environment are determined through obtaining a first topological relation and a second topological relation; the network link between the virtual equipment and the external traditional environment is opened through the acquisition of the third topological relation; and acquiring a fourth topological relation through the daemon, and opening the network link acquisition between the container and the entity host or the virtual host. According to the acquired topological relation, the network topological relation among the host equipment, the virtual machine equipment, the container and the three-layer nested structure equipment in the network environment can be determined, so that the financial institution can clearly acquire the network topological condition of the financial institution, and convenience is provided for the financial institution to search the network asset and subsequently perform fault location, migration and the like on application business.

Drawings

FIG. 1 is a flow diagram of a method of determining network topology of a financial institution network environment in one embodiment;

FIG. 2 is a flow diagram of the steps for determining a second topological relationship in one embodiment;

FIG. 3 is a flow diagram of determining network topology information of a financial institution network environment in one embodiment;

FIG. 4 is a schematic diagram of a financial institution network environment in another embodiment;

FIG. 5 is a schematic diagram of a network topology determination method of a financial institution network environment in one embodiment;

FIG. 6 is a schematic diagram of an architecture of a network device acquisition module for information acquisition in one embodiment;

FIG. 7 is a schematic diagram of an architecture of a server acquisition module for information acquisition in one embodiment;

FIG. 8 is a schematic diagram of an architecture for determining network topology information of a financial institution network environment in one embodiment;

FIG. 9 is a block diagram of a network topology determination apparatus of a financial institution network environment in one embodiment;

fig. 10 is an internal structural view of a computer device in one embodiment.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.

The application provides a network topology determination method, a device, computer equipment, a storage medium and a computer program product of a financial institution network environment, which are applied to the fields of network technology, information security and financial science and technology.

In one embodiment, as shown in fig. 1, a network topology determining method of a financial institution network environment is provided, and this embodiment is applied to a terminal for illustration by using the method, it is understood that the method may also be applied to a server, and may also be applied to a system including the terminal and the server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the steps of:

step S101, a first topological relation between information forwarding devices in a financial institution network environment and a second topological relation between a host device and the information forwarding devices in the financial institution network environment are obtained.

Specifically, in this step, the topology relationship between network devices in the conventional environment in the financial institution network environment is acquired. The information forwarding device may include traditional forwarding devices such as a firewall, a switch, a router, a load balancing device, and network devices with external exposed services of IaaS and PaaS clouds. The first topological relation among the information forwarding devices can be determined by obtaining forwarding rules of the forwarding devices and the like.

Further, in this step, a second topological relation between the host device and the information forwarding device is also acquired. Specifically, the host device may be bare metal, a conventional server, a host of a virtual machine, a resource node within the cloud, and the like. The second topological relation between the information forwarding device and the corresponding host device can be obtained according to the forwarding rule of the information forwarding device, and the second topological relation between the information forwarding device and the host device can be determined by obtaining the forwarding rule of the host device.

Step S102, in the case where the host device runs the virtual device, determining a third topological relation between the host device and the virtual device.

Specifically, for the host device, the Agent can adaptively query the network device information of the host device by means of implanting the Agent, check whether the network device information contains the virtual network card, if so, the Agent can consider that the host device runs with the virtual device, namely, acquire the network conversion relationship between the virtual device and the host device, and determine the third topological relationship between the host device and the virtual device.

Step S103, when the host device or the virtual device is provided with a container, acquiring a fourth topological relation of the container through a container daemon deployed on the host device or the virtual device; the fourth topological relation comprises a topological relation between the container and the host device or a topological relation between the container and the virtual network device.

Specifically, when a host device or a virtual device is provided with a container, the host device or the virtual device may be regarded as a resource node, and a plurality of resource nodes may form a cluster. In this step, the container daemon is in a form of a DeamonSet, and the container daemon is in a form of a DeamonSet, so that the container daemon is deployed on each resource node of the cluster by batch pushing, and a connection and a network address conversion relationship between the container and the resource node are acquired by collecting forwarding table items and routing information of the resource node, so as to determine a fourth topological relationship between the container and a host device or a virtual device serving as the resource node.

Step S104, determining network topology information of the financial institution network environment according to the first topological relation, the second topological relation, the third topological relation and the fourth topological relation.

Specifically, after the first topological relation, the second topological relation, the third topological relation and the fourth topological relation are obtained according to the steps, network connection information including information exchange equipment-host equipment, information exchange equipment-host equipment-virtual equipment, information exchange equipment-host equipment-container, information exchange equipment-host equipment-virtual equipment-container and other different network connection conditions in the financial institution network environment can be confirmed by combining with different topological relations, and then overall network topology information of the financial institution network environment is obtained.

In the network topology determining method of the financial institution network environment, the network topology information of the financial institution network environment is determined by acquiring a first topology relationship among information forwarding devices in the financial institution network environment, a second topology relationship among the host device and the information forwarding devices, and a third topology relationship among the host device and the virtual device, and acquiring a fourth topology relationship among a container running on the host device or the virtual device and a host thereof through a container daemon, and determining the network topology information of the financial institution network environment according to the first topology relationship, the second topology relationship, the third topology relationship and the fourth topology relationship. The method comprises the steps that network links of a traditional environment in a network environment are determined through obtaining a first topological relation and a second topological relation; the network link between the virtual equipment and the external traditional environment is opened through the acquisition of the third topological relation; and acquiring a fourth topological relation through the daemon, and opening the network link acquisition between the container and the entity host or the virtual host. According to the acquired topological relation, the network topological relation among the host equipment, the virtual machine equipment, the container and the three-layer nested structure equipment in the network environment can be determined, so that the financial institution can clearly acquire the network topological condition of the financial institution, and convenience is provided for the financial institution to search the network asset and subsequently perform fault location, migration and the like on application business.

In one embodiment, as shown in fig. 2, in step S101, obtaining a second topological relation between a host device and an information forwarding device in a financial institution network environment includes:

in step S201, when the information forwarding device is a load balancing device, the information forwarding device logs in to the configuration information access account provided by the information forwarding device.

Step S202, the load balancing rule between the information forwarding device pre-configured by the information forwarding device and the corresponding host device is obtained through the configuration information access account.

Step S203, determining a second topological relation between the information forwarding device and the corresponding host device according to the load balancing rule.

Specifically, the load balancing device is an information forwarding device that provides a load balancing forwarding function through software or hardware, and is used for distributing loads among a plurality of host devices so as to achieve the purposes of optimal resource utilization and the like. For ease of management, the load balancing device typically provides a configuration information access account to which configuration information in the information forwarding device may be accessed by logging in.

In this embodiment, the load balancing rule between the information forwarding device and the corresponding host device may be obtained from the configuration information by logging in to the configuration information access account through SSH (secure shell protocol) or the like. The load balancing rule records a rule how the information forwarding device forwards information for the corresponding host device. According to the load balancing rule, the connection relationship between the information forwarding device and the corresponding host device can be obtained, and the second topological relationship between the information forwarding device and the corresponding host device can be determined by combining the forwarding rule.

According to the method and the device for obtaining the access relationship between the load balancing equipment and the real server at the rear end, the situation that the load balancing equipment exists in the information forwarding equipment is considered, and the access relationship between the load balancing equipment and the real server at the rear end can be obtained smoothly by obtaining the load balancing rule of the load balancing equipment, so that the second topological relationship in the network environment can be obtained more comprehensively.

In one embodiment, in the step S101, the obtaining a first topological relation between the information forwarding devices in the network environment of the financial institution includes: acquiring forwarding rules of each information forwarding device according to a protocol used by each information forwarding device in a financial institution network environment; and determining a first topological relation among the information forwarding devices according to the forwarding rules.

Specifically, when the first topological relation among the information forwarding devices in the financial institution network environment is acquired, the corresponding forwarding rule of the information forwarding devices can be acquired in different modes according to the protocol used by the information forwarding devices, wherein the forwarding rule is a rule used by the information forwarding devices when forwarding information received from other devices, such as a next hop address when forwarding certain information. From which the topological relation between each other can be determined.

For example, for an information forwarding device that has opened an SNMP protocol (simple network management protocol), the topology relationship between the information forwarding device and other information forwarding devices may be inferred by acquiring its forwarding rule through MIB (management information base) of the information forwarding device and acquiring the interface address of its direct-connection neighbor according to a routing table. For an information forwarding device that does not open the SNMP protocol, ICMP (internet control message protocol) may be used for probing, and the network topology relationship between the information forwarding device and other information forwarding devices may be determined according to the next hop address obtained by traceroute. On the other hand, for an information transfer apparatus using the ipv6 protocol, the next-hop address of the information transfer apparatus can also be acquired by employing NDP (neighbor discovery protocol), so that the network topology relationship between the information transfer apparatus and other information transfer apparatuses can be determined. Further, for the information forwarding devices that enable dynamic routing protocols such as RIP (routing information protocol), OSPF (open shortest path first protocol) or BGP (border gateway protocol), the link reachability information or the route reachability information exchanged by the dynamic routing protocol may be queried to obtain the network topology relationship between the plurality of information forwarding devices using the protocol.

The embodiment uses different acquisition modes to acquire the forwarding rules of the protocols supported by different information forwarding devices, is suitable for complex situations that information forwarding devices using different protocols exist in a financial institution network environment at the same time, successfully acquires the network topology relationship among the information forwarding devices in the network environment, and is easier to adapt to other types of information forwarding devices added later.

In one embodiment, in the step S101, obtaining a first topological relation between information forwarding devices in a financial institution network environment and a second topological relation between a host device and an information forwarding device in the financial institution network environment includes: and acquiring a forwarding rule of the host device, and determining a second topological relation between the host device and the information forwarding device according to the forwarding rule.

Specifically, for the host device, the forwarding rule is a rule adopted when the host device forwards the information to other devices, according to the forwarding rule, the information forwarding device corresponding to the host device when the host device forwards the information can be determined, and the second topological relation between the two can be determined according to the forwarding rule.

In this embodiment, the Agent implanted on the host device may collect the routing table of the host device, and obtain, according to the next-hop address information in the routing table, the address of the information forwarding device corresponding to the host device, to determine the second topological relation between the host device and the information forwarding device.

The second topological relation between the host equipment and the information forwarding equipment is determined by acquiring the forwarding rule of the host equipment, the acquisition of the second topological relation can be more accurately realized, and in the case that the second topological relation is acquired at one side of the information forwarding equipment, the acquired results at two sides can be mutually verified, so that the more accurate topological relation can be obtained.

In one embodiment, in step S102, where the host device runs a virtual device, determining a third topological relation between the host device and the virtual device includes: and under the condition that the host equipment runs with the virtual equipment, acquiring a third topological relation between the host equipment and the virtual equipment according to bridging network connection and/or network address conversion information in the host equipment.

Specifically, when the host device runs with the virtual device, the virtual device generally realizes network connection with the host device through a bridge mode (bridge) or a network address translation mode (NAT, network Address Translation), so that if an Agent running on the host device queries that the host device includes a virtual network card, the virtual device adopting the bridge mode can further acquire information of the virtual network card and routing information of the virtual device hanging on the virtual bridge, and a third topological relation between the virtual device hanging on the virtual bridge and the host device is obtained; for the virtual device adopting the network address conversion mode, the address conversion relation between the virtual network card and the network card of the host device can be obtained by collecting the conversion table entry on the host device, so that the third topological relation between the corresponding virtual device and the host device is obtained.

According to the network connection characteristics between the host device and the virtual device, the embodiment obtains the third topological relation between the host device and the virtual device according to the bridging network connection and/or the network address conversion information, and can conveniently and quickly obtain the third topological relation.

In one embodiment, in step S102, where the host device runs a virtual device, determining a third topological relation between the host device and the virtual device includes: and under the condition that the host equipment bears the load balancing function, acquiring a load balancing rule of the host equipment as a third topological relation between the host equipment and the virtual equipment.

Specifically, for a host device running with a virtual device, it may also use a plurality of virtual devices as a cluster, and distribute a load to the plurality of virtual devices in the cluster through a load balancing function to improve performance and reliability of the service. According to load balancing rules of the host device, a network topology relationship between the host device and virtual devices in the cluster may be determined.

In this embodiment, after the routing table of the host device is obtained, whether the host device has a load balancing function or not may be determined according to the forwarding information therein, and if so, the network topology relationship between the host device and each virtual device in the cluster may be obtained through the forwarding table entry of the host device.

The embodiment considers the situation that the host device performs load balancing forwarding on the plurality of virtual devices, and rapidly and accurately obtains the third topological relation according to the load balancing rule.

In one embodiment, in step S103, when the host device or the virtual device is provided with a container, the obtaining, by the container daemon corresponding to the container, the fourth topological relation includes: when the host device or the virtual device bears the load balancing function, a load balancing rule between a container acquired by a daemon on the host device or the virtual device and the host device or the virtual device is acquired and is used as a fourth topological relation.

Specifically, for a host device or a virtual device in which a container is provided in a container cluster, the host device or the virtual device can distribute a load to itself or to a container on other resource nodes in the cluster through a load balancing function.

When the host device or the virtual device is provided with a container, whether each resource node in the cluster bears the load balancing function or not can be judged through the daemon, when the resource node bears the load balancing function, a load balancing rule which is specifically used by the resource node is collected, and a forwarding relationship between the resource node and the container in the load balancing rule is used as a fourth topological relationship.

According to the embodiment, the load balancing forwarding of the resource node to the container is considered, the daemon process collects the load balancing rule to obtain the fourth topological relation, and the network connection relation between the resource node and the container which is continuously generated and destroyed can be better reflected.

In one embodiment, as shown in fig. 3, in step S104, determining network topology information of the financial institution network environment according to the first topology relationship, the second topology relationship, the third topology relationship, and the fourth topology relationship includes:

step S301, determining physical access links between entity devices in a financial network environment according to the first topological relation and the second topological relation;

step S302, determining a virtual access link between entity equipment and virtual equipment in the financial network environment according to a third topological relation;

step S303, determining a container access link between the physical device or the virtual device and the container in the financial network environment according to the fourth topological relation;

step S304, a network topology structure diagram of the financial institution network environment is constructed as network topology information according to the physical access link, the virtual access link and the container access link.

Specifically, after the first topological relation is obtained according to the method in the above embodiment, the network connection relation between the information forwarding devices in the financial institution network environment can be obtained. And according to the second topological relation, the connection relation between each host device and the corresponding information forwarding device in the financial network environment can be obtained. Therefore, by combining the first topological relation and the second topological relation, network topological information which can embody end-to-end access among all entity devices in the financial institution network environment can be obtained, and physical access links among the entity devices can be obtained. And according to the third topological relation, network connection relation between each virtual device in the financial institution network environment and the host device serving as the host machine thereof, namely virtual access link, can be obtained. Further, for the container in the financial institution network environment, the network connection relationship between the container and the virtual device or the host device serving as the resource node thereof, that is, the container access link, may be obtained according to the fourth topological relationship. According to the physical access link, the virtual access link and the container access link, various entities or virtual network devices in the financial institution network environment can be associated with each other, and network topology information in the whole environment is presented.

In this embodiment, the network topology information may be visually displayed through a network topology structure diagram. For example, the information forwarding device, the host device, the virtual device and the container in the financial institution network environment can be respectively used as nodes of a network topology structure diagram, and edges are formed among different nodes according to the physical access link, the virtual access link and the container access link, so that topology information display of the whole network is realized.

According to the embodiment, the physical access link, the virtual access link and the container access link are obtained according to various topological relations, and a network topological structure diagram of the financial institution network environment is further constructed, so that the network topological relation in the financial institution network environment can be visually displayed, and the user can check and maintain the connection relation of the whole network.

In one embodiment, in the step S304, a network topology structure diagram of the financial institution network environment is constructed according to the physical access link, the virtual access link, and the container access link, and the network topology structure diagram includes: obtaining hardware load balancing information according to load balancing rules of load balancing equipment, and obtaining virtual load balancing information according to load balancing rules of host equipment or virtual equipment carrying a load balancing function; and adding the hardware load balancing information and the virtual load balancing information to a network topology structure diagram.

Specifically, in this embodiment, for an information forwarding device that belongs to a load balancing device, hardware load balancing information is obtained according to a load balancing rule thereof, where the hardware load balancing information may include an identifier of the load balancing device, an identifier of a host device corresponding to which load distribution is performed, and so on.

And for the host device or the virtual device carrying the load balancing function, obtaining virtual load balancing information according to the load balancing rule, wherein the virtual load balancing information can comprise the identification of the host device or the virtual device carrying the load balancing function, the identification of the corresponding virtual device or the container carrying the load balancing function, and the like.

After the hardware load balancing information and the virtual load balancing information are obtained, the corresponding network equipment identification can be highlighted or annotated and the like, and the hardware load balancing information and the virtual load balancing information can be added into a network topology structure diagram. When the hardware load balancing information and the virtual load balancing information also comprise other information, such as some special load distribution rules, the hardware load balancing information and the virtual load balancing information can also be added into the network topology structure diagram together through annotation and other methods.

According to the embodiment, the load balancing information is added into the network topology structure diagram, the network equipment and the container related to load balancing are visually displayed, the connection relation in the network environment is more accurately mastered by a user, and more convenient conditions are provided for subsequent operation such as application business fault positioning.

In order to further illustrate the network topology determination method of the financial institution network environment of the present application, it is explained below by way of detailed embodiments.

As shown in fig. 4, an exemplary network environment of a financial institution that needs to perform network topology determination in this embodiment is shown, where the network environment includes an information forwarding device such as a switch, a router, a firewall, etc., a host device in a conventional server form, a host device running with a virtual device, a host device provided with a container, and a three-layer nesting device running on the host device and further provided with a container on the virtual device.

As shown in fig. 5 to 7, in this embodiment, information is collected on each information forwarding device through a network device collection module, information is collected on a host device or a virtual device through a server collection module, and network topology information of a financial institution network environment is determined and displayed through a summary display module.

The network device acquisition module may acquire, according to the method in the foregoing embodiment, for a conventional information forwarding device, a forwarding rule of the device according to a protocol specifically used in the information forwarding device, and acquire, according to the rule, a first topological relationship between the information forwarding device and other information forwarding devices; and for the load balancing equipment in the information forwarding equipment, logging in the configuration information access account of the equipment through the SSH to acquire a second topological relation between the equipment and the corresponding host equipment.

The server acquisition modules are respectively deployed on the host equipment and the virtual equipment to acquire corresponding information. For a host device serving as a traditional server or a virtual device host, the server acquisition module can be implanted in the form of an Agent, acquires a routing table of the host device, and acquires a second topological relation between the host device and a corresponding information forwarding device according to forwarding rules of the routing table. Further, the server acquisition module adaptively inquires network equipment information of the host equipment, judges whether the virtual network card is contained or not, if so, judges that the host equipment runs with the virtual equipment, and further acquires a third network relation between the host equipment and the virtual equipment. For the host equipment or the virtual equipment serving as the container resource node, the server acquisition module is in butt joint with the container cluster in a DaemonSet form, pushes and deploys the container cluster on each resource node in batches, and acquires the forwarding relation of the resource node to an external network and the connection and network address conversion relation of the container and the resource node by acquiring the forwarding table item and the routing information of the resource node. That is, when the resource node is a host device, the corresponding second topological relation and fourth topological relation can be obtained; when the resource node is a virtual device, a corresponding third topological relation and a corresponding fourth topological relation can be obtained. Further, for the host device or the virtual device carrying the load balancing function, the server acquisition module acquires the network topological relation between the device and the corresponding virtual device or the container for distributing the load by acquiring the corresponding load balancing rule.

Further, as shown in fig. 8, in this embodiment, the network device acquisition module and the server acquisition module acquire the first topology relationship, the second topology relationship, the third topology relationship and the fourth topology relationship respectively, and then send them to the summary display module for calculation. The summarizing and displaying module consists of a computing server and a visual web end. The computing server classifies various topological relation information, determines a physical link (equivalent to a physical access link in the above embodiment) according to the first topological relation and the second topological relation, determines a virtual link (equivalent to a virtual access link and a container access link in the above embodiment) related to virtual equipment and a container according to the third topological relation and the fourth topological relation, and obtains a network topological relation of the whole network environment by combining the physical link and the virtual link. When load balancing is used in the network, for the part related to load balancing, the calculation server can calculate the topological relation of the whole network according to the sequence of the first topological relation, the hardware load balancing, the second topological relation, the virtual load balancing, the third topological relation, the virtual load balancing and the fourth topological relation in the process of calculating the topological relation. And the visualized web side generates a visualized topological graph according to the network topology information obtained by the computing server, so that a user can inquire the whole network topology and service access link information.

The specific method for obtaining various topological relations in the financial institution network environment, the method for determining the network topology information, and the process for generating the network topology map may refer to the description of the foregoing embodiments, which are not repeated herein.

In this embodiment, on the one hand, multiple network topology conditions existing in the network environment of the financial institution are considered, and through respective acquisition processes of the network device acquisition module and the server acquisition module, association between the traditional and virtual environments and association between the virtual environments and the virtual environments are opened, so that overall topology acquisition of the network environment including three layers of nested devices can be realized. On the other hand, for the situation of using load balancing, in the physical link, the load balancing configuration obtained by the network equipment acquisition module can obtain the access relation of the public network ip-load balancing-rear-end real server in the whole network topology forwarding relation; in the virtual link, because the virtual load balancing is realized through the host forwarding table, the forwarding relation of the load balancing can be mastered by acquiring forwarding rules on the forwarding table of the virtual device or the host device, and the access link of the load balancing is added in the association from the bottom physical link to the virtual link. Thus, the acquisition of all-link topology including various load balancing can be realized from various physical to virtual and virtual to virtual in the network environment.

It should be understood that, although the steps in the flowcharts related to the embodiments described above are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides a network topology determining device of the financial institution network environment for realizing the network topology determining method of the financial institution network environment. The implementation of the solution provided by the apparatus is similar to the implementation described in the above method, so the specific limitation in the embodiments of the network topology determining apparatus for one or more financial institution network environments provided below may refer to the limitation of the network topology determining method for a financial institution network environment hereinabove, and will not be repeated herein.

In one embodiment, as shown in fig. 9, there is provided a network topology determining apparatus 900 of a financial institution network environment, comprising:

a first topology obtaining module 901, configured to obtain a first topology relationship between information forwarding devices in a financial institution network environment, and a second topology relationship between a host device and the information forwarding devices in the financial institution network environment;

a second topology obtaining module 902, configured to determine, in a case where the host device runs a virtual device, a third topology relationship between the host device and the virtual device;

a third topology obtaining module 903, configured to obtain, when the host device or the virtual device is provided with a container, a fourth topology relationship of the corresponding container through a container daemon deployed on the host device or the virtual device; the fourth topological relation comprises a topological relation between the container and the host device or a topological relation between the container and the virtual network device;

the topology summarization module 904 is configured to determine network topology information of the financial institution network environment according to the first topology relationship, the second topology relationship, the third topology relationship, and the fourth topology relationship.

In one embodiment, the first topology obtaining module 901 is further configured to log in to a configuration information access account provided by the information forwarding device when the information forwarding device is a load balancing device; acquiring a load balancing rule between the information forwarding equipment and the corresponding host equipment, which is preconfigured by the information forwarding equipment, through the configuration information access account; and determining a second topological relation between the information forwarding equipment and the corresponding host equipment according to the load balancing rule.

In one embodiment, the first topology obtaining module 901 is further configured to obtain a forwarding rule of each information forwarding device according to a protocol used by each information forwarding device in the financial institution network environment; and determining a first topological relation among the information forwarding devices according to the forwarding rules.

In one embodiment, the first topology obtaining module 901 is further configured to obtain a forwarding rule of the host device, and determine a second topology relationship between the host device and the information forwarding device according to the forwarding rule.

In one embodiment, the second topology obtaining module 902 is further configured to obtain, when the host device runs with a virtual device, a third topology relationship between the host device and the virtual device according to bridging network connection and/or network address translation information in the host device.

In one embodiment, the second topology obtaining module 902 is further configured to obtain, as a third topological relation between the host device and the virtual device, a load balancing rule of the host device in a case where the host device carries a load balancing function.

In one embodiment, the third topology obtaining module 903 is further configured to obtain, as the fourth topology relationship, a load balancing rule between the container collected by the daemon on the host device or the virtual device and the host device or the virtual device when the host device or the virtual device carries a load balancing function.

In one embodiment, the topology summarization module 904 is further configured to determine a physical access link between entity devices in the financial network environment according to the first topology relationship and the second topology relationship; determining a virtual access link between entity equipment and virtual equipment in the financial network environment according to the third topological relation; determining a container access link between the physical device or the virtual device and the container in the financial network environment according to the fourth topological relation; and constructing a network topology structure diagram of the financial institution network environment as the network topology information according to the physical access link, the virtual access link and the container access link.

In one embodiment, the topology summarization module 904 is further configured to obtain hardware load balancing information according to a load balancing rule of the load balancing device, and obtain virtual load balancing information according to a load balancing rule of a host device or a virtual device that carries a load balancing function; and adding the hardware load balancing information and the virtual load balancing information to the network topology structure diagram.

The respective modules in the network topology determination apparatus of the financial institution network environment described above may be implemented in whole or in part by software, hardware, and combinations thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a terminal, and an internal structure diagram thereof may be as shown in fig. 10. The computer device includes a processor, a memory, an input/output interface, a communication interface, a display unit, and an input means. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program when executed by a processor implements a network topology determination method for a financial institution network environment. The display unit of the computer device is used for forming a visual picture, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be a key, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.

It will be appreciated by those skilled in the art that the structure shown in FIG. 10 is merely a block diagram of some of the structures associated with the present inventive arrangements and is not limiting of the computer device to which the present inventive arrangements may be applied, and that a particular computer device may include more or fewer components than shown, or may combine some of the components, or have a different arrangement of components.

In an embodiment, there is also provided a computer device comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the method embodiments described above when the computer program is executed.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when executed by a processor, carries out the steps of the method embodiments described above.

In an embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the method embodiments described above.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the embodiments provided herein may include at least one of a relational database and a non-relational database. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processor referred to in the embodiments provided in the present application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, or the like, but is not limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The foregoing examples illustrate only a few embodiments of the application and are described in detail herein without thereby limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application. Accordingly, the scope of the application should be assessed as that of the appended claims.

Claims

1. A method for determining a network topology of a financial institution network environment, the method comprising:

2. The method of claim 1, wherein obtaining a second topological relationship between a host device and the information forwarding device in the financial institution network environment comprises:

when the information forwarding equipment is load balancing equipment, logging in to a configuration information access account provided by the information forwarding equipment;

acquiring a load balancing rule between the information forwarding equipment and the corresponding host equipment, which is preconfigured by the information forwarding equipment, through the configuration information access account;

and determining a second topological relation between the information forwarding equipment and the corresponding host equipment according to the load balancing rule.

3. The method of claim 1, wherein the obtaining a first topological relationship between information handling devices in a financial institution network environment comprises:

acquiring forwarding rules of each information forwarding device according to a protocol used by each information forwarding device in the financial institution network environment;

and determining a first topological relation among the information forwarding devices according to the forwarding rules.

4. The method of claim 1, wherein obtaining a second topological relationship between a host device and the information forwarding device in the financial institution network environment comprises:

and acquiring a forwarding rule of the host equipment, and determining a second topological relation between the host equipment and the information forwarding equipment according to the forwarding rule.

5. The method of claim 1, wherein the determining a third topological relationship between the host device and the virtual device if the host device is running with a virtual device comprises:

and under the condition that the host equipment runs with the virtual equipment, acquiring a third topological relation between the host equipment and the virtual equipment according to bridging network connection and/or network address conversion information in the host equipment.

6. The method of claim 1, wherein the determining a third topological relationship between the host device and the virtual device if the host device is running with a virtual device comprises:

and under the condition that the host equipment bears a load balancing function, acquiring a load balancing rule of the host equipment as a third topological relation between the host equipment and the virtual equipment.

7. The method of claim 1, wherein the obtaining, by the container daemon corresponding to the container, the fourth topological relation when the host device or the virtual device is provided with the container comprises:

and when the host equipment or the virtual equipment bears a load balancing function, acquiring a load balancing rule between the container acquired by a daemon on the host equipment or the virtual equipment and the host equipment or the virtual equipment as the fourth topological relation.

8. The method of any one of claims 1 to 7, wherein determining network topology information of the financial institution network environment from the first, second, third, and fourth topologies comprises:

Determining physical access links between entity devices in the financial network environment according to the first topological relation and the second topological relation;

determining a virtual access link between entity equipment and virtual equipment in the financial network environment according to the third topological relation;

determining a container access link between the physical device or the virtual device and the container in the financial network environment according to the fourth topological relation;

and constructing a network topology structure diagram of the financial institution network environment as the network topology information according to the physical access link, the virtual access link and the container access link.

9. The method according to claim 8, wherein constructing a network topology structure diagram of the financial institution network environment from the physical access link, the virtual access link, and the container access link as the network topology information includes:

acquiring hardware load balancing information according to the load balancing rule of the load balancing device, and acquiring virtual load balancing information according to the load balancing rule of the host device or the virtual device carrying the load balancing function;

and adding the hardware load balancing information and the virtual load balancing information to the network topology structure diagram.

10. A network topology determination apparatus of a financial institution network environment, the apparatus comprising:

11. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any one of claims 1 to 9 when the computer program is executed.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any one of claims 1 to 9.