WO2021238048A1 - 用于交换机的数据同步方法、装置和拟态交换机 - Google Patents

用于交换机的数据同步方法、装置和拟态交换机 Download PDF

Info

Publication number
WO2021238048A1
WO2021238048A1 PCT/CN2020/124399 CN2020124399W WO2021238048A1 WO 2021238048 A1 WO2021238048 A1 WO 2021238048A1 CN 2020124399 W CN2020124399 W CN 2020124399W WO 2021238048 A1 WO2021238048 A1 WO 2021238048A1
Authority
WO
WIPO (PCT)
Prior art keywords
data synchronization
mimic
heterogeneous
message
synchronized
Prior art date
Application number
PCT/CN2020/124399
Other languages
English (en)
French (fr)
Inventor
于波
武彦平
李彧
Original Assignee
网络通信与安全紫金山实验室
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网络通信与安全紫金山实验室 filed Critical 网络通信与安全紫金山实验室
Publication of WO2021238048A1 publication Critical patent/WO2021238048A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Definitions

  • This application relates to the technical field of network security protection, and more specifically, to a data synchronization method, device and mimic switch based on the STP protocol.
  • the mimic defense mechanism uses dynamic defense and redundant structure as the core mechanism, which can effectively respond to or resist known risks or uncertain threats based on loopholes and backdoors.
  • a mimic switch is a typical application of mimic defense technology, which usually uses multiple heterogeneous processors as heterogeneous execution bodies.
  • the mimic switch contains a mimic scheduler implemented by hardware.
  • the mimic scheduler is used to realize the judgment on the downlink data of heterogeneous executive bodies for screening and so on.
  • the current data synchronization scheme mainly uses heterogeneous executors to periodically synchronize data with the mimic scheduler.
  • the mimic scheduler saves these data, and then obtains it from the mimic scheduler when the heterogeneous executors need to be synchronized later.
  • this method of data synchronization has major shortcomings.
  • One is that a large amount of memory needs to be occupied on the mimic scheduler to save the topology data of the Spanning Tree Protocol (STP). Valuable memory resources are a great waste.
  • This synchronization method also needs to modify the STP protocol stack code on the heterogeneous executive body. Because there can be various CPU architectures and kernel versions on the heterogeneous executive body, if you want to An adaptation will bring a huge workload, and the application is very complicated.
  • This application provides an improved data synchronization method for a switch, a data synchronization device and a mimic switch.
  • a data synchronization method for a switch includes the data synchronization module in the mimic scheduler confirming the start of synchronization according to the received STP message, wherein the STP message is sent by the heterogeneous executor to be synchronized; the data synchronization module collects configuration BPDUs Message; the data synchronization module generates a configuration BPDU message for synchronization according to the collected configuration BPDU message and sends it to the heterogeneous execution body to be synchronized for data synchronization; and the mimic scheduler marks the synchronization completion of the heterogeneous execution body.
  • the data synchronization module collecting configuration BPDU messages includes: the data synchronization module collecting configuration BPDU messages sent by the external switch; and the data synchronization module collecting and collecting has been determined by mimicry The module decides that it is a reliable configuration BPDU message.
  • the data synchronization module generates a new configuration BPDU message for synchronization according to the collected configuration BPDU message and sends it to the heterogeneous execution body to be synchronized for data synchronization including: the data synchronization module is based on The collected configuration BPDU messages are self-trained to determine the status and port information of the bridge, and a new configuration BPDU message for synchronization is generated and sent to the heterogeneous executor to be synchronized; and the heterogeneous executor to be synchronized is based on all The received new configuration BPDU message performs STP port status and information synchronization.
  • the data synchronization module self-trains to determine the status and port information of the bridge based on the collected configuration BPDU messages, and generates a new configuration BPDU message for synchronization
  • sending to the heterogeneous executor to be synchronized includes: when the local bridge is the root bridge, the data synchronization module sends configuration BPDU messages from different ports to the heterogeneous executor to be synchronized, wherein the configuration BPDU message provides The priority of the root bridge is lower than the priority of the current bridge; when the current bridge is not the root bridge, the root bridge is elected, and the data synchronization module sends a configuration BPDU message that simulates the root port to the heterogeneous actors to be synchronized, where the The message content is consistent with the root bridge BPDU message actually received by the local bridge.
  • the method further includes: the heterogeneous executor to be synchronized sends the STP message to the mimic scheduler after its cleaning recovery, so that the mimic scheduling
  • the data synchronization module in the device confirms the start of synchronization according to the received STP message.
  • the data synchronization module in the mimic scheduler confirms the start of synchronization according to the received STP message, and further includes: the mimic decision module of the mimic scheduler receives the STP message, and does not correct the STP message. In the case of a mimic decision on the message, the STP message is directly transferred to the data synchronization module.
  • a data synchronization device includes a mimic judgment module, which is configured to receive messages sent by each heterogeneous executive body, and determine whether the messages sent by each heterogeneous executive body are reliable; and a data synchronization module, which is configured to In the case of a heterogeneous executor, collect configuration BPDU messages sent by external switches and collect configuration BPDU messages that have been judged to be reliable by the mimic decision module, and use the collected configuration BPDU messages to generate new BPDU messages for synchronization, and combine all the configuration BPDU messages. The generated new BPDU message is sent so that the heterogeneous actors to be synchronized can be synchronized.
  • a mimic switch including the data synchronization device described herein is also provided.
  • a mimic switch including the data synchronization method for the switch described herein.
  • the heterogeneous executors use the mimic scheduler to synchronize data, which wastes a lot of storage space during synchronization.
  • Manually matching the STP protocol stack code on the heterogeneous executor is very complicated and cumbersome.
  • This application provides A data synchronization method, device and mimic switch based on the STP protocol. By adding an STP data synchronization module, the STP protocol stack code of the heterogeneous executive body does not need to be manually modified, and the cleaning and recovery are completed without occupying additional storage resources. The data of the latter heterogeneous executor and other heterogeneous executors are synchronized.
  • a data synchronization method based on the STP protocol confirms the start of synchronization according to the received STP message, which is sent by the heterogeneous execution body to be synchronized; the data synchronization module collects configuration BPDU messages, and According to the collected configuration BPDU message, the configuration BPDU message for synchronization is encapsulated, and then sent to the heterogeneous executor to be synchronized for data synchronization; the mimic scheduler marks the heterogeneous executor that has completed synchronization.
  • the data synchronization module completes the collection and learning of the topology information of each port of the STP, and synchronizes to the heterogeneous executors after cleaning and restoration, so as to realize the data synchronization of the heterogeneous executors.
  • the mimic scheduler marks the heterogeneous executor into a normal working state, and subsequent data packets sent by the heterogeneous executor need to perform mimic judgment together with the data packets of other heterogeneous executors.
  • the data synchronization module collecting and sending the configuration BPDU message for synchronization to the heterogeneous execution entity to be synchronized includes the following steps:
  • the data synchronization module collects configuration BPDU messages sent by other external switches;
  • the data synchronization module collects the configuration BPDU messages sent by the synchronized heterogeneous executors.
  • the configuration BPDU messages of the synchronized heterogeneous executors are first judged by the mimic judgment module, and the reliable configuration BPDU messages are sent to the data synchronization module;
  • the data synchronization module self-trains to determine the status and port information of the bridge, and sends it to the heterogeneous executive body to be synchronized after encapsulation;
  • the heterogeneous executors to be synchronized perform STP port status and information synchronization.
  • the data synchronization module When the data synchronization module synchronizes, it first collects the configuration BPDU messages sent by the normal working heterogeneous execution body and the external switch, and conducts self-training according to the information carried to obtain the correct current bridge state and port information, and then encapsulates it into a new BPDU by itself Messages are sent to the heterogeneous executors to be synchronized to help them synchronize data.
  • Normally working heterogeneous executors are synchronized heterogeneous executors. Synchronized heterogeneous executors regularly send configuration BPDU messages to the outside world. The interval for regularly sending configuration BPDU messages is 2 seconds by default. Since BPDU messages are all data messages that conform to the protocol, there is no need to modify the code of the STP protocol stack on the heterogeneous executive body. You only need to update your local status and data according to the collected information to complete the topology of each port. Information and status settings.
  • the synchronization of data and state of all heterogeneous executors is carried out through the mimic scheduler.
  • the normal working heterogeneous executive body will judge the data through the mimic judgment module.
  • the mimic judgment module After the mimic judgment module receives the data, it will judge according to the mimic strategy to ensure that the data is safe and reliable. If the mimic judgment module judges that the data is abnormal, it will not be sent to the data. Synchronization module.
  • step S3 when the local bridge is the root bridge, the data synchronization module sends BPDU messages from different ports to the heterogeneous actors to be synchronized, and the root bridge priority provided by this message is lower than the local bridge.
  • the priority of the bridge when the current bridge is not the root bridge, the root bridge is elected, and the data synchronization module simulates sending a BPDU message from the root port to the heterogeneous execution body to be synchronized.
  • the content of the message is the same as the actual received by the bridge
  • the contents of the root bridge BPDU packets are the same.
  • the data synchronization module confirms the bridge status and port information of the heterogeneous executor to be synchronized through self-training, and the bridge status is confirmed by the configuration BPDU information of the external switch and the synchronized heterogeneous executor.
  • steps S1 to S4 are repeated until the states of the isomeric executor to be synchronized and the isomeric executor to be synchronized are consistent. Due to the continuous changes in the network topology, the network structure may have changed after the data synchronization of the heterogeneous executors to be synchronized is completed, and synchronization needs to be performed again at this time. The synchronization process may be repeated several times until the heterogeneous executors to be synchronized The status and information of all ports are consistent with the normal working heterogeneous executive body.
  • the heterogeneous executor After the heterogeneous executor is cleaned and restored, it sends an STP message to the data synchronization module to trigger the data synchronization module to start synchronization. At this time, the heterogeneous executor after cleaning and restoration is the heterogeneous executor to be synchronized. Heterogeneous executors become available after being cleaned and restored, and the state and data of the STP protocol stack of the heterogeneous executors need to be synchronized to restore normal operation.
  • the heterogeneous executor to be synchronized has just completed cleaning and restoration, and the mimic judgment module does not perform mimicry judgment on the STP message sent by the heterogeneous executor, and directly transfers to the data synchronization module.
  • Heterogeneous executors need to be cleaned and restored when they encounter external attacks or internal errors. After the cleanup and recovery, the heterogeneous executors are restored to a usable state. Since the heterogeneous executors have just been cleaned and restored, the system defaults to their security and mimicry.
  • the mimic judgment module in the scheduler does not perform mimic judgment on the STP message sent by the heterogeneous executive body.
  • a data synchronization device uses the data synchronization method of the STP protocol on the mimic switch.
  • the data synchronization device includes a mimic judgment module and a data synchronization module, and the mimic judgment module is in communication connection with the data synchronization module.
  • a data synchronization device is provided in the mimic scheduler, including a mimic decision module and a data synchronization module.
  • the mimic decision module makes a reliability decision on the information sent by the heterogeneous executors according to the mimic strategy.
  • the data synchronization module is capable of processing STP
  • the ability of protocol messages can collect the configuration BPDU messages of the normally working heterogeneous executors and the configuration BPDU messages sent by other external switches, self-training to obtain the current bridge and port status, and send them to the heterogeneous executors to be synchronized. Realize data synchronization.
  • a mimic switch includes a mimic scheduler, and the data synchronization device is arranged in the mimic scheduler.
  • the mimic switch also includes a number of heterogeneous executive bodies and switching chips, each of the heterogeneous executive bodies is connected to the mimic scheduler through a data communication interface, and the mimic scheduler is also connected to the switching chip through a data communication interface.
  • a data synchronization module is set in the mimic scheduler of the mimic switch, so that the STP protocol stack code of the heterogeneous execution body to be synchronized is not modified, and the memory of the mimic scheduler is not occupied, and the cleaning and recovery of the heterogeneous execution body is completed.
  • the subsequent data synchronization saves storage space, with fast synchronization speed and high efficiency. After the heterogeneous executive body is abnormal due to external attacks or internal errors, it can quickly recover to normal working status, with better stability, and ensuring the safety and reliability of the network system.
  • a data synchronization device is provided in the mimic scheduler of the mimic switch to realize data synchronization.
  • the data synchronization module is added to complete the collection and network topology information of each port of STP through the STP protocol. Learn and synchronize the recovered heterogeneous executors to synchronize their data with other heterogeneous executors.
  • the data synchronization module only collects configuration BPDU information of heterogeneous executive bodies, which greatly saves the storage space of the mimic scheduler. Information synchronization is carried out through the data synchronization module, eliminating the need for manual modification of the STP protocol stack code on the heterogeneous execution body, and the synchronization speed is fast and efficient. After a single or multiple heterogeneous executors are abnormal due to external attacks or internal errors, this application can restore the normal operation of the abnormal heterogeneous executors in time, ensure system stability, and improve the overall reliability and stability of the network architecture.
  • Figure 1 is a schematic structural diagram of a mimic switch according to an example of the present application.
  • Fig. 2 is a flowchart of a method for synchronization based on the STP protocol according to an example of the present application.
  • Fig. 1 is a schematic structural diagram of a mimic switch according to an example of the present application.
  • the data synchronization method of heterogeneous executive bodies according to the example of the present application can be applied to, for example, the mimic switch shown in FIG. 1.
  • the mimic switch includes a heterogeneous executive body 10 and a mimic scheduler 12, and optionally, a switch chip 14.
  • the heterogeneous executor 10 includes multiple heterogeneous executors, and each heterogeneous executor is connected to the mimic scheduler 12 through a data communication interface.
  • the heterogeneous executor 1 illustrated in the heterogeneous executor 10 communicates through data
  • the interface 1112 is connected to the mimic scheduler 12
  • the heterogeneous executor 2 exemplified in the heterogeneous executor 10 is connected to the mimic scheduler 12 through the data communication interface 1212
  • the heterogeneous executor n exemplified in the heterogeneous executor 10 is connected through the data communication interface 1312 is connected to the mimic scheduler 12.
  • the mimic scheduler 12 is connected to the switching chip 14 through the data communication interface 124.
  • the data synchronization module 122 is provided in the mimic scheduler 12, and the module 122 is configured to synchronize the STP state and data of the heterogeneous executives after cleaning and restoration.
  • the data synchronization module 122 can process STP protocol messages, and the data synchronization module 122 is configured to collect the configuration bridge protocol data unit (Bridge Protocol Data Unit, BPDU) messages of the normally working heterogeneous executive bodies and BPDUs sent from external switches. The message comes from my training to get the current bridge and port status.
  • BPDU configuration bridge protocol data unit
  • the data synchronization module 122 obtains the status and information of each port, and forwards them to the heterogeneous executors to be synchronized, so that the STP protocol of the heterogeneous executors to be synchronized
  • the stack performs data synchronization, so that the heterogeneous executors after cleaning and recovery can work normally.
  • the normally working heterogeneous executor and the BPDU message sent by the external switch will be used by the data synchronization module 122 to self-train to construct a heterogeneous executor for abnormal synchronization. Therefore, the text will also It is called the configuration BPDU message.
  • Fig. 2 is a flowchart of a method for synchronization based on the STP protocol according to an example of the present application.
  • the method of synchronization based on the STP protocol according to the example of the present application will be explained in conjunction with FIG. 1 and FIG. 2. It should be noted that, although the method shown in FIG. 2 is described in conjunction with the mimic switch shown in FIG. 1, the method shown in FIG. 2 can also be applied to other mimic switches.
  • step S1 the mimic scheduler 12 receives a notification of completion of cleaning and restoration of a certain heterogeneous executor, and then directly forwards the message sent by the heterogeneous executor to the data synchronization module.
  • a certain heterogeneous executor mentioned here is an isomer that has previously been abnormal, and has been cleaned and restored. It may be one heterogeneous executor or multiple.
  • the mimic scheduler 12 finds that a certain heterogeneous executor is abnormal, that is, cleans and restores the abnormal heterogeneous executor.
  • the mimic decision module 120 in the mimic scheduler 12 receives messages from each heterogeneous executor through each data communication interface, and determines that each heterogeneous executor is normal according to the decision strategy preset in the state decision module 120 Or not.
  • the setting of the decision strategy can be different according to the application scenario.
  • the decision strategy can be a message sent by a heterogeneous executor whose port, status and other information are different from most heterogeneous executors, that is, the execution isomer is considered abnormal.
  • the mimic judgment module 120 determines that the isomer is abnormal, that is, it notifies the processing module (not shown) of the mimic scheduler 12, and it notifies or controls the abnormal execution isomer to perform cleaning and recovery.
  • the heterogeneous executors that have completed the cleaning and restoration will send a restoration completion notification to the mimic scheduler 12.
  • the cleaning and recovery of heterogeneous executors is by setting a recovery agent for each protocol in the mimic scheduler 12 to assist the recovery of the state of the heterogeneous executor in the way of training.
  • the heterogeneous executor in an abnormal working state can be quickly restored to the normal working state without modifying the protocol stack on the heterogeneous executor.
  • Heterogeneous executors will return to the usable state after cleaning and recovery.
  • the state and data of the STP protocol stack need to be synchronized to make the heterogeneous executors work normally. Since the heterogeneous executor has just been cleaned and restored, the mimic switch defaults to its security.
  • the mimic decision module 120 in the mimic scheduler 12 does not perform mimic judgment on the STP message sent by the heterogeneous executor, but directly Send it to the data synchronization module 122.
  • step S2 the data synchronization module 122 analyzes the received STP message, and when it confirms that STP synchronization is required, it starts to collect configuration BPDU messages sent by each normally working heterogeneous executive body and other external switches.
  • the data synchronization module 122 parses the received STP message of the heterogeneous executors to be synchronized, and determines to start STP data synchronization.
  • the mimic scheduler 12 collects configuration BPDU messages sent by various heterogeneous executive bodies and external switches that are working normally.
  • the BPDU message is an information frame exchanged between devices running the STP protocol.
  • the BPDU message contains the information required for communication based on the STP protocol. Path and priority information.
  • the data synchronization module 122 uses this information to determine the root bridge of the mimic switch and the path to the root bridge from each heterogeneous entity.
  • step S3 the normally working heterogeneous executor sends a configuration BPDU message.
  • each heterogeneous executive will periodically send configuration BPDU messages, and the time interval for regularly sending configuration BPDU messages is 2s by default.
  • the configuration BPDU message carries information such as the status of the current bridge and port information. Among them, the bridge status information is used to confirm the root bridge, and the port information is used to confirm each port in the network topology.
  • Heterogeneous executors that have not been attacked or have generated errors are in normal working conditions, and periodically send configuration BPDU messages to the outside. Heterogeneous executors in the normal working state will not be cleaned and restored, and the network status has not changed. The heterogeneous executors in the normal state can be considered as synchronized heterogeneous executors.
  • step S4 the configuration BPDU message is subjected to the mimic judgment by the mimic judgment module 120, and is forwarded to the data synchronization module 122 by the mimic scheduler 12 after the reliability is guaranteed.
  • the mimic decision module 120 in the mimic scheduler 12 determines the reliability of the configuration BPDU message. After the mimetic decision module 120 decides that the configuration BPDU message is reliable, it will forward the configuration BPDU message decided to be reliable to the data synchronization module 120. The mimic decision module 120 discards the configuration BPDU message that is determined to be unreliable.
  • the mimic decision module 120 determines whether the output of the heterogeneous executor is normal or abnormal according to the set mimic strategy, confirms that the heterogeneous executor that outputs normal data is reliable, and sends a reliable configuration BPDU message to the switch chip 14, and the switch chip 14 Forward to other mimic switches (not shown); for the heterogeneous executor with abnormal mimic judgment, the configuration BPDU message is not forwarded, and when it is confirmed that the abnormal heterogeneous executor needs to be cleaned and restored, notify the mimic scheduler 12
  • the processing module (not shown), which informs or controls the abnormal execution isomer to perform cleaning and recovery.
  • step S5 the data synchronization module 122 self-trains to determine the current STP port information, generates a new configuration BPDU message, and sends it to the heterogeneous executor to be synchronized.
  • the data synchronization module 122 receives the configuration BPDU message sent by the mimicry decision module 120, performs self-training according to the current state, and generates a new configuration BPDU message. Specifically, the data synchronization module 122 confirms the root bridge according to the bridge status information in the configuration BPDU information sent by the normal working heterogeneous executive body and the external switch. If the current bridge is the root bridge, at this stage, BPDU messages from different ports (ie, configuration BPDU messages) are sent to the heterogeneous executor to be synchronized to confirm the network topology of the heterogeneous executor to be synchronized structure.
  • the priority of the root bridge provided by the sent BPDU messages is lower than the priority of the local bridge, so that the STP protocol stack on the heterogeneous executive body recognizes itself as the root bridge, and its ports are all designated ports (DP).
  • the data synchronization module 122 sends a BPDU message that simulates the root port to the heterogeneous execution entity to be synchronized.
  • the contents of the received root bridge BPDU packets are consistent.
  • step S6 the heterogeneous executor to be synchronized performs STP port status and information synchronization with the received new configuration BPDU message generated by the data synchronization module 122.
  • the STP protocol stack on the heterogeneous executive body to be synchronized performs normal processing according to the received new configuration BPDU message generated by the data synchronization module 122, and updates the corresponding bridge status and port information.
  • Step S7 and steps S2 to S6 may be repeated multiple times until the isomeric executor to be synchronized is consistent with other isomeric executors that are working normally.
  • the steps from S2 to S6 may need to be repeated multiple times to synchronize according to the actual situation, until the heterogeneous executor completes the status and information synchronization of all ports, and the port status of other normal working heterogeneous executors Wait to be consistent.
  • step S8 the mimic scheduler 12 marks the heterogeneous executor that has completed synchronization to indicate that it is in a normal working state.
  • Performing the synchronization method based on the STP protocol described here can enable heterogeneous executors with abnormal operating states in the mimic switch to complete data synchronization after cleaning and recovery, and the mimic scheduler will mark the heterogeneous executors that have completed data synchronization. Indicates that it has entered a normal working state. In the follow-up work, the data packets issued by the heterogeneous executor will need to be mimicked together with the data packets of other heterogeneous executors.
  • the data synchronization module 12 determines to perform data synchronization according to the received STP message, and then triggers the execution of the method shown in FIG. 2, for example, and starts to collect configuration BPDU messages sent by normal working heterogeneous executors , And the configuration BPDU message sent by other external mimic switches, self-train according to the information carried to obtain the correct current bridge state and port information, and then generate a new BPDU message and send it to the heterogeneous execution body to be synchronized To help it synchronize data.
  • the encapsulated new BPDU message is a data message conforming to the STP protocol, there is no need to make any changes to the code of the STP protocol stack configured on the heterogeneous executive body, and you can update your local state according to the BPDU message And data, complete the topology information and status settings of each port.
  • a data synchronization device includes a mimic judgment module and a data synchronization module.
  • the mimic decision module is configured to receive messages sent by each heterogeneous executor, and judge whether the messages sent by each heterogeneous executor are reliable.
  • the data synchronization module is configured to collect the configuration BPDU messages sent by the external switch and the configuration BPDU messages that have been judged to be reliable by the mimic decision module when it is determined that there are heterogeneous actors to be synchronized, and use the collected configuration BPDU messages to generate To synchronize the new BPDU message, and send the generated new BPDU message, so that the heterogeneous actors to be synchronized can be synchronized.
  • the data synchronization device according to the present application can be implemented by the mimic decision module 120 and the data synchronization module 122 described in conjunction with FIG. 1.
  • the part marked by the dashed box in FIG. 1 with the number 22 is the data synchronization device according to the example of the present application.
  • a mimic switch is also provided, which includes a data synchronization device 22.
  • the mimic switch shown in FIG. 1 is an embodiment of the mimic switch according to this example.
  • a mimic switch as shown in FIG. 1 is also provided, which can execute the data synchronization method for the switch described in each example of the present application.
  • the data synchronization device uses a data synchronization method of heterogeneous execution bodies as described in Embodiment 1 to perform data synchronization.
  • the data synchronization device includes a mimic judgment module and a data synchronization module, and the mimic judgment module is connected with the data synchronization module and communicates with each other.
  • the mimic judgment module makes a judgment on the data sent by the heterogeneous executor, sends the data of the heterogeneous executor in the normal state to the switching chip after the judgment, and cleans and restores the heterogeneous executor in the abnormal state.
  • the mimic decision module also determines the configuration BPDU message sent by the heterogeneous execution body in the normal state to ensure reliability and then sends it to the data synchronization module.
  • the data synchronization module receives and parses the STP message of the heterogeneous executors to be synchronized after cleaning and recovery. After confirming the start of STP data synchronization, the data synchronization module collects the configuration BPDU messages sent by the heterogeneous executors and external switches that are working normally, and the data synchronization module According to the received data self-training, the current STP port information is determined, and a new BPDU message is generated and sent to the heterogeneous execution body to be synchronized to realize data synchronization.
  • This embodiment describes a mimic switch, which includes several heterogeneous executive bodies, a mimic scheduler, and a switching chip. Each heterogeneous executive body is connected to the mimic scheduler through a data communication interface, and the mimic scheduler is also connected to the switching chip through the data communication interface.
  • the exchange chip is only an example of a specific implementation of user data exchange, and it is not limited that the part used for data exchange must be implemented as a chip.
  • the heterogeneous executors are processors based on different architectures (such as X86, ARM, RISC-V, MIPS, etc.), and the heterogeneous executors run the control plane software of the exchange protocol required by the mimic switch to realize the configuration of the switching chip And so on.
  • the mimic scheduler includes a data communication interface and a data synchronization device of heterogeneous execution bodies as described above.
  • the data synchronization module in the data synchronization device is connected to the switching chip through the data communication interface, and the data of the external switch is sent to the data synchronization module through the data communication interface;
  • the mimic judgment module in the data synchronization device is connected to the heterogeneous executive body through the data communication interface, and the mimic judgment is made Modules and heterogeneous executives communicate with each other.
  • the mimic judgment module is used to realize the judgment on the downlink data of multiple heterogeneous executors, select the correct data to send according to the judgment result, avoid system abnormality caused by the error of the heterogeneous executor, and determine the heterogeneity according to the judgment result and mimic strategy Whether the status of the executive body is normal, if the status of the heterogeneous executive body is abnormal, it needs to be cleaned and restored.
  • a data synchronization module is set in the mimic scheduler of the mimic switch, so that the data synchronization after the cleaning and restoration of heterogeneous execution bodies is completed without modifying the STP protocol stack code and not occupying too much memory, thereby saving the mimic scheduler
  • the storage space is fast, the synchronization speed is high and the efficiency is high. After the heterogeneous executive body is abnormal due to external attacks or internal errors, it will resume normal work in time to ensure system stability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供用于交换机的数据同步方法，在拟态交换机中异构执行体清洗恢复后，通过数据同步模块完成STP各端口的拓扑信息的收集和自我训练，再同步给清洗恢复后的待同步异构执行体，完成其的数据同步，恢复正常使用。本申请还提供数据同步装置和拟态交换机。

Description

用于交换机的数据同步方法、装置和拟态交换机 技术领域
本申请涉及网络安全防护技术领域，更具体地说，涉及一种基于STP协议的数据同步方法、装置和拟态交换机。
背景技术
随着网络技术的不断发展，网络安全已成为当前一个重要的研究课题。拟态防御机制通过将动态防御加冗余结构作为为核心机制，能有效地应对或抵御基于漏洞、后门等已知风险或不确定威胁。
拟态交换机是拟态防御技术的一种典型应用，其通常使用多个异构处理器作为异构执行体。拟态交换机包含由硬件实现的拟态调度器。拟态调度器用来实现对异构执行体下行数据进行判决以作筛选等。
由于外部攻击或内部错误可能导致异构执行体出现异常，所以需要根据拟态策略，及时地对该异构执行体进行清洗恢复。通过清洗恢复可以让异构执行体恢复到可用状态，但是还需要让该异构执行体的状态和其他正常的异构执行体进行同步后，才能正常工作。出于安全考虑，异构执行体之间没有通讯通路，所以数据和状态的同步都是通过拟态调度器进行。
目前的数据同步方案，主要是通过异构执行体定期往拟态调度器进行数据同步，拟态调度器保存这些数据，再在后面异构执行体需要同步的时候，从拟态调度器进行获取。但这种数据同步的方式，存在着较大的缺点，一个是需要在拟态调度器上占用大量的内存来保存生成树协议(Spanning Tree Protocol,STP)的拓扑数据，这对拟态调度器芯片上宝贵的内存资源是极大的浪费，该同步方法还需要修改异构执行体上的STP协议栈代码，由于异构执行体上可以有各种各样的CPU架构和内核版本，如果都要一一适配，将带来巨大的工作量，应用起来十分复杂。
申请内容
本申请提供改进的用于交换机的数据同步方法，数据同步装置和拟态交换机。
根据本申请的一个方面，提供用于交换机的数据同步方法。该用于交换机的数据同步方法包括拟态调度器中的数据同步模块根据收到的STP消息确认同步开始，其中，所述STP消息由待同步异构执行体发送；所述数据同步模块收集配置BPDU消息；所述数据同步模块根据收集到的配置BPDU消息生成用于同步的配置BPDU消息并发送至待同步异构执行体 以便其进行数据同步；以及拟态调度器标记同步完成的所述异构执行体。
在一些示例中，该用于交换机的数据同步方法中，数据同步模块收集配置BPDU消息包括：所述数据同步模块收集外部交换机发送的配置BPDU消息；以及所述数据同步模块收集收集已经由拟态判决模块判决为可靠的配置BPDU消息。在又一些示例中，所述数据同步模块根据收集到的配置BPDU消息生成用于同步的新的配置BPDU消息并发送至待同步异构执行体以便其进行数据同步包括：所述数据同步模块基于所述收集的配置BPDU消息，自我训练确定网桥的状态和端口信息，生成用于同步的新的配置BPDU消息并发送至待同步异构执行体；以及所述待同步异构执行体基于所接收的新的配置BPDU消息进行STP端口状态和信息同步。
在一些示例中，该用于交换机的数据同步方法中，所述数据同步模块基于所述收集的配置BPDU消息，自我训练确定网桥的状态和端口信息，生成用于同步的新的配置BPDU消息并发送至待同步异构执行体包括：在本网桥是根桥时，所述数据同步模块向待同步异构执行体发送来自各不同端口的配置BPDU消息，其中，该配置BPDU消息提供的根桥优先级低于本网桥的优先级；在本网桥不是根桥时，选举根桥，所述数据同步模块向待同步异构执行体发送模拟根端口的配置BPDU消息，其中，该消息内容与本网桥实际接收到的根桥BPDU消息一致。
在一些示例中，该用于交换机的数据同步方法中，所述方法还包括：待同步的异构执行体在其清洗恢复后发送所述STP消息至所述拟态调度器，以便所述拟态调度器中的所述数据同步模块根据收到的STP消息确认同步开始。在又一些示例中，所述拟态调度器中的数据同步模块根据收到的STP消息确认同步开始进一步包括：所述拟态调度器的拟态判决模块接收将所述STP消息，并在不对所述STP消息进行拟态判决的情况下，将所述STP消息直接转至所述数据同步模块。
根据本申请的又一方面，还提供数据同步装置。该数据同步装置包括拟态判决模块，其被配置为接收各异构执行体发送的消息，并判断各异构执行体发送的消息是否可靠；以及数据同步模块，其被配置为在确定存在待同步异构执行体时，收集外部交换机发送的配置BPDU消息以及收集已经由拟态判决模块判决为可靠的配置BPDU消息，并以所收集的配置BPDU消息生成用于同步的新的BPDU消息，以及将所生成的新的BPDU消息发出，以便待同步异构执行体同步。
根据本申请的再一方面，还提供包括在此描述的数据同步装置的拟态交换机。
根据本申请的另外的方面，还提供包括执行在此描述的用于交换机的数据同步方法的拟态交换机。
根据本申请，示例地，解决如下描述的技术问题，提供如下描述的具体方案。
1.要解决的技术问题
针对现有技术中存在的在拟态交换机中，异构执行体通过拟态调度器进行数据同步，同步时浪费大量存储空间，手动匹配异构执行体上STP协议栈代码，十分复杂繁琐，本申请提供一种基于STP协议的数据同步方法、装置和拟态交换机，通过增加STP数据同步模块，实现不用手动修改异构执行体的STP协议栈代码，同时也不占用额外存储资源的情况下，完成清洗恢复后异构执行体和其他异构执行体的数据同步。
2.技术方案
本申请的目的通过以下技术方案实现。
一种基于STP协议的数据同步方法，拟态调度器中的数据同步模块根据收到的STP消息确认同步开始，所述STP消息由待同步异构执行体发送；数据同步模块收集配置BPDU消息，并根据收集到的配置BPDU消息封装用于同步的配置BPDU消息，然后发送至待同步异构执行体进行数据同步；拟态调度器标记同步完成的异构执行体。本申请通过数据同步模块完成STP各端口的拓扑信息的收集和学习，并同步给清洗恢复后的异构执行体，实现异构执行体的数据同步。数据同步完成拟态调度器标记该异构执行体进入正常工作状态，后续该异构执行体下发的数据包都需要和其他异构执行体的数据包一起进行拟态判决。
更进一步的，数据同步模块收集并发送用于同步的配置BPDU消息至待同步异构执行体包括以下步骤：
S1、数据同步模块收集外部其他交换机发送的配置BPDU消息；
S2、数据同步模块收集已同步异构执行体发送的配置BPDU消息，已同步异构执行体的配置BPDU消息先经过拟态判决模块进行判决，判决可靠的配置BPDU消息发送给数据同步模块；
S3、数据同步模块自我训练确定网桥的状态和端口信息，封装后发送给待同步异构执行体；
S4、待同步异构执行体进行STP端口状态和信息同步。
数据同步模块同步时先收集正常工作的异构执行体和外部交换机发送的配置BPDU消息，根据其中携带的信息进行自我训练得到正确的当前网桥的状态和端口信息，再自行封装成新的BPDU报文，发送给待同步异构执行体，帮助其进行数据同步。
正常工作的异构执行体即已同步异构执行体，已同步异构执行体定期对外发送配置BPDU消息，定期发送配置BPDU消息的时间间隔默认为2秒。由于BPDU报文都是符合协议的数据报文，所以异构执行体上的STP协议栈的代码无需做特殊修改，只需根据收集到的 信息更新自己的本地状态和数据，完成各端口的拓扑信息和状态的设置。
由于异构执行体之间无法通讯，所有异构执行体数据和状态的同步，都是通过拟态调度器来进行的。数据同步时，正常工作的异构执行体将数据通过拟态判决模块进行判决，拟态判决模块接收到数据后根据拟态策略判断确保数据是安全可靠的，如果拟态判决模块判断数据异常将不发送给数据同步模块。
更进一步的，步骤S3中：当本网桥是根桥时，数据同步模块向待同步异构执行体发送来自各不同端口的BPDU报文，该报文提供的根桥优先级都低于本网桥的优先级；当本网桥不是根桥时，选举根桥，数据同步模块向待同步异构执行体上模拟发送来自根端口的BPDU报文，该报文内容与网桥实际接收到的根桥BPDU报文内容一致。数据同步模块通过自我训练确认待同步异构执行体的网桥状态和端口信息，所述网桥状态由外部交换机和已同步异构执行体的配置BPDU信息确认。
更进一步的，重复步骤S1至S4，直到待同步异构执行体和已同步异构执行体状态一致。由于网络拓扑结构的不断变化，待同步异构执行体数据同步完成后网络结构可能已发生变化，此时就需要再次进行同步，所述同步过程可能会重复数次，直到待同步异构执行体所有端口的状态和信息等与正常工作的异构执行体保持一致。
更进一步的，异构执行体清洗恢复后发送STP消息至数据同步模块，触发数据同步模块开始同步，此时清洗恢复后的异构执行体为待同步异构执行体。异构执行体清洗恢复后为可用状态，需再对异构执行体的STP协议栈状态和数据进行同步，使其恢复正常工作。
更进一步的，所述待同步异构执行体刚完成清洗恢复，拟态判决模块对该异构执行体发送的STP消息不进行拟态判决，直接转至数据同步模块。异构执行体遇到外部攻击或内部错误产生异常时需进行清洗恢复，清理恢复后异构执行体恢复至可用状态，由于异构执行体刚清洗恢复完毕，系统默认其安全性得到保障，拟态调度器中的拟态判决模块对该异构执行体发送的STP消息不进行拟态判决。
一种数据同步装置，使用所述的一种拟态交换机上STP协议的数据同步方法。
更进一步的，所述数据同步装置包括拟态判决模块和数据同步模块，拟态判决模块与数据同步模块通信连接。本申请在拟态调度器内设置数据同步装置，包括拟态判决模块和数据同步模块，所述拟态判决模块对异构执行体发送的信息根据拟态策略进行可靠性判决，所述数据同步模块具备处理STP协议消息的能力，可以通过收集正常工作的异构执行体的配置BPDU消息和外部其他交换机发过来的配置BPDU消息，自我训练得到当前的网桥和端口状态，发送给待同步异构执行体，实现数据同步。
一种拟态交换机，包括拟态调度器，所述拟态调度器内设置所述的数据同步装置。
更进一步的，所述拟态交换机还包括若干异构执行体和交换芯片，每个异构执行体都通过数据通信接口与拟态调度器连接，拟态调度器还通过数据通信接口连接交换芯片。
本申请在拟态交换机的拟态调度器内设置数据同步模块，实现不修改待同步异构执行体的STP协议栈代码，也不占用过多拟态调度器内存的情况下，完成异构执行体清洗恢复后的数据同步，节省存储空间，同步速度快、效率高。在异构执行体由于外部攻击或内部错误导致异常后能快速恢复正常工作状态，稳定性更好，保证网络系统的安全可靠。
3.有益效果
相比于现有技术，本申请的优点在于：
本申请在拟态交换机的拟态调度器内，设置数据同步装置实现数据同步。在不修改异构执行体上STP协议栈代码，同时也不需要在拟态调度器上占用额外的存储资源的情况下，通过增加数据同步模块，通过STP协议完成STP各端口网络拓扑信息的收集和学习，并同步给清洗恢复后的异构执行体，使其和别的异构执行体的数据同步。
数据同步模块只收集异构执行体的配置BPDU信息，极大节省拟态调度器的存储空间。通过数据同步模块进行信息同步，省去对异构执行体上STP协议栈代码的手动修改，同步速度快、效率高。在单个或多个异构执行体由于外部攻击或内部错误导致异常后，本申请能及时恢复异常的异构执行体正常工作，保证系统稳定性，提升网络架构整体的可靠性和稳定性。
附图说明
当参考附图阅读下面的详细描述时，本公开的这些和其它特征、方面和优点将变得更好理解，在所有附图中，相似的字符表示相似的部分，其中：
图1为根据本申请一个示例的拟态交换机的结构示意图；以及
图2为根据本申请示例的基于STP协议同步的方法的流程图。
具体实施方式
下面结合说明书附图，对本申请作详细描述。
图1为根据本申请一个示例的拟态交换机的结构示意图。根据本申请示例的异构执行体的数据同步方法可应用于例如图1所示的拟态交换机。
如图1所示，拟态交换机包括异构执行体10和拟态调度器12，以及可选地，还包括交换芯片14。异构执行体10包括多个异构执行体，每个异构执行体都通过一个数据通信接口与拟态调度器12连接，例如，异构执行体10中示例的异构执行体1通过数据通信接口1112连接拟态调度器12，异构执行体10中示例的异构执行体2通过数据通信接口1212连接拟态 调度器12，以及异构执行体10中示例的异构执行体n通过数据通信接口1312连接拟态调度器12。拟态调度器12通过数据通信接口124连接交换芯片14。
数据同步模块122设置在拟态调度器12中，该模块122被配置为同步清洗恢复后的异构执行体的STP状态和数据。数据同步模块122可处理STP协议消息，且数据同步模块122被配置为通过收集正常工作的异构执行体的配置网桥协议数据单元(Bridge Protocol Data Unit，BPDU)消息和外部交换机发来的BPDU消息来自我训练，从而得到当前的网桥和端口状态。通过和正常工作的异构执行体之间基于STP协议的消息交互，数据同步模块122获得各端口的状态和信息，转发给待同步异构执行体，以使待同步异构执行体的STP协议栈进行数据同步，进而使清洗恢复后的异构执行体正常工作。在本申请的示例中，正常工作的异构执行体和外部交换机发送的BPDU消息将被数据同步模块122用来自我训练，以构建用于同步异常的异构执行体，因此，在文本也将其称呼为配置BPDU消息。
图2是根据本申请示例的基于STP协议同步的方法流程图。示例而非限制地，将结合图1和图2阐述根据本申请示例的基于STP协议同步的方法。需要说明的是，尽管在此是结合图1所示的拟态交换机来阐述图2所示的方法，但图2所示的方法也可应用在其它拟态交换机中。
如图2所示，在步骤S1、拟态调度器12收到某异构执行体清洗恢复完成的通知后，便将该异构执行体发送的消息直接转发到数据同步模块。其中，在此提到的某异构执行体是之前异常，已经执行了清洗恢复的异构体，可能是一个异构执行体也可能是多个。
拟态调度器12发现某个异构执行体异常，即对该异常的异构执行体进行清洗恢复。举例来说，拟态调度器12中的拟态判决模块120通过各数据通信接口接收来自各异构执行体的消息，且根据预设在态判决模块120中的判决策略来判定各异构执行体正常与否。判决策略的设置可根据应用昌场景而不同。作为示例，在基于STP协议的通信中，判决策略可以是在异构执行体发送的消息，其端口、状态等信息不同于大多数异构执行体时，即认为该执行异构体异常。拟态判决模块120判断异构体异常，即通知拟态调度器12的处理模块(未图示)，由其通知或控制该异常的执行异构体进行清洗恢复。清洗恢复完成的异构执行体将发送恢复完成通知给拟态调度器12。
作为示例，异构执行体的清洗恢复是通过在拟态调度器12中对每种协议设置恢复代理，以训练的方式协助异构执行体清洗时完成状态的恢复。如此，可在无需修改异构执行体上协议栈的情况下，使处于异常工作状态的异构执行体快速恢复到正常工作状态。异构执行体清洗恢复完成后便回到可用状态，此时，需要再对STP协议栈的状态和数据进行同步，以使得异构执行体正常工作。由于该异构执行体刚经过清洗恢复，拟态交换机默认其安全，拟态调 度器12中的拟态判决模块120在这种情况下不对该异构执行体发送过来的STP消息进行拟态判决，而是直接将其发送给数据同步模块122。
在步骤S2、数据同步模块122解析收到的STP消息，确认需要进行STP同步时，则开始收集每个正常工作的异构执行体和外部其他交换机发送过来的配置BPDU消息。
数据同步模块122解析接收到的待同步异构执行体的STP消息，确定要开始STP数据同步。通过拟态调度器12收集各个正常工作的异构执行体以及外部交换机发送过来的配置BPDU消息，BPDU消息是运行STP协议的设备之间交换的信息帧，BPDU消息包含基于STP协议的通信所需的路径和优先级信息，数据同步模块122利用这些信息来确定拟态交换机的根桥以及到各异构执行体到根桥的路径。
在步骤S3、正常工作的异构执行体发送配置BPDU消息。
按照STP协议，每个异构执行体都会定期发送配置BPDU消息，定期发送配置BPDU消息的时间间隔默认为2s。配置BPDU消息中携带当前网桥的状态和端口信息等信息，其中，网桥状态信息用以确认根桥，端口信息用以确认网络拓步结构中的各端口。未被攻击或产生错误的异构执行体都处于正常工作状态，定期对外发送配置BPDU消息。正常工作状态的异构执行体不会被清洗恢复，网络状态没有变化，可以认为正常状态的异构执行体为已同步异构执行体。
在步骤S4、配置BPDU消息经过拟态判决模块120的拟态判决，在保证可靠性后由拟态调度器12转发给数据同步模块122。
由拟态调度器12中的拟态判决模块120来判决配置BPDU消息的可靠性。拟态判决模块120在判决该配置BPDU消息可靠后，即将判决可靠的配置BPDU消息转发给数据同步模块120。拟态判决模块120将判决不可靠的配置BPDU消息丢弃。拟态判决模块120根据所设置的拟态策略判决异构执行体输出正常或异常，将输出正常数据的异构执行体确认为可靠，并将可靠的配置BPDU消息发送至交换芯片14，由交换芯片14转发给其他拟态交换机(未示出)；对于拟态判决异常的异构执行体，不转发其配置BPDU消息，并在确认该异常异构执行体需要清洗恢复的情况下，通知拟态调度器12的处理模块(未图示)，由其通知或控制该异常的执行异构体进行清洗恢复。
在步骤S5、数据同步模块122自我训练确定当前STP各端口信息，生成一个新的配置BPDU消息发送给待同步异构执行体。
数据同步模块122接收拟态判决模块120发送的配置BPDU消息，根据当前所处的状态进行自我训练，生成新的配置BPDU消息。具体地说，数据同步模块122根据正常工作异构执行体和外部交换机发送的配置BPDU信息中的网桥状态信息确认根网桥。如果本网桥为根 网桥，则在此阶段，向待同步异构执行体发送来自各不同端口的BPDU报文(即，配置BPDU消息)，用以确认待同步异构执行体所在网络拓扑结构。所发送的BPDU报文提供的根桥优先级都低于本网桥的优先级，以便该异构执行体上的STP协议栈认定自己为根网桥，其端口都为指定端口(DP)。
如果本网桥不是根网桥，则选举根网桥，这种情况下，数据同步模块122向待同步异构执行体发送模拟根端口的BPDU报文，该报文的内容与本网桥实际接收到的根桥BPDU报文内容一致。
在步骤S6、待同步异构执行体以所接收的由数据同步模块122生成的新的配置BPDU消息进行STP端口状态和信息同步。
待同步异构执行体上的STP协议栈根据收到的由数据同步模块122生成的新的配置BPDU消息进行正常处理，更新相应的网桥状态和端口信息。
在步骤S7、步骤S2至S6可能重复多次，直到待同步异构执行体和其他正常工作的异构执行体保持一致。
由于网络拓扑结构的不断变化，S2至S6的步骤根据实际情况可能需要重复多次进行同步，直到该异构执行体完成所有端口的状态和信息同步，和其他正常工作的异构执行体端口状态等保持一致。
可选地，在步骤S8、拟态调度器12标记已完成同步的该异构执行体，以表明其为正常工作状态。
执行在此所述的基于STP协议同步的方法，能够使拟态交换机中运行状态异常的异构执行体在清洗恢复后完成数据同步，并且拟态调度器会标记完成数据同步的该异构执行体，表明其进入正常工作状态。后续工作中，该异构执行体下发的数据包将需要和其他异构执行体的数据包一起进行拟态判决。
根据本申请的示例，数据同步模块12根据收到的STP消息，确定要进行数据同步后触发例如图2所示的方法的执行，开始收集由正常工作的异构执行体所发出的配置BPDU消息，以及由外部其他拟态交换机发过来的配置BPDU消息，根据其中携带的信息自我训练得到正确的当前网桥的状态和端口信息，再自行生成新的BPDU报文，发送给待同步异构执行体，帮助其进行数据同步。由于所封装的新的BPDU报文是符合STP协议的数据报文，所以无需对配置在异构执行体上的STP协议栈的代码做任何修改，即可根据该BPDU报文更新自己的本地状态和数据，完成各端口的拓扑信息和状态的设置。
根据本申请的一些实施例，还提供数据同步装置。该数据同步装置包括拟态判决模块和数据同步模块。拟态判决模块被配置为接收各异构执行体发送的消息，并判断各异构执行体 发送的消息是否可靠。数据同步模块被配置为在确定存在待同步异构执行体时，收集外部交换机发送的配置BPDU消息以及收集已经由拟态判决模块判决为可靠的配置BPDU消息，并以所收集的配置BPDU消息生成用于同步的新的BPDU消息，以及将所生成的新的BPDU消息发出，以便待同步异构执行体同步。
作为示例，根据本申请的数据同步装置可由结合图1描述的拟态判决模块120和数据同步模块122实现。如此，图1中虚线框标示出的标号为22的部分即为根据本申请示例的数据同步装置。
根据本申请的示例，还提供拟态交换机，其包括数据同步装置22。图1所示的拟态交换机是根据该示例的拟态交换机的一种实施例。
根据本申请的示例，还提供如图1所示的拟态交换机，其能够执行根据本申请各示例描述的用于交换机的数据同步方法。
本申请提供数据同步装置，可应用于拟态交换机。该数据同步装置使用如实施例1所述的一种异构执行体的数据同步方法进行数据同步。所述数据同步装置包括拟态判决模块和数据同步模块，拟态判决模块与数据同步模块连接并互相通信。
拟态判决模块对异构执行体发送的数据进行判决，判决后将正常状态的异构执行体的数据发送给交换芯片，以及将异常状态的异构执行体清理恢复。在数据同步过程中，拟态判决模块还将正常状态异构执行体发送的配置BPDU消息判决确保可靠后发送给数据同步模块。
数据同步模块接收清洗恢复后待同步异构执行体STP消息并解析，确认开始STP数据同步后，数据同步模块收集各正常工作的异构执行体以及外部交换机发送过来的配置BPDU消息，数据同步模块根据接收到的数据自我训练确定当前STP各端口信息，生成一个新的BPDU消息发送给待同步异构执行体，实现数据同步。
本实施例描述一种拟态交换机，包括若干异构执行体、拟态调度器和交换芯片。每个异构执行体都通过一个数据通信接口与拟态调度器连接，拟态调度器还通过数据通信接口连接交换芯片。在本申请所有示例中，交换芯片只是用户数据交换的一种具体实现的示例，并非限定该用于数据交换的部分必须实现为芯片。
所述异构执行体为基于不同架构(如：X86、ARM、RISC-V、MIPS等)的处理器，异构执行体运行拟态交换机所需交换协议的控制面软件，实现对交换芯片的配置等操作。
所述拟态调度器包括数据通信接口和如上文所述的异构执行体的数据同步装置。数据同步装置中的数据同步模块通过数据通信接口连接交换芯片，外部交换机的数据通过数据通信接口发送给数据同步模块；数据同步装置中的拟态判决模块通过数据通信接口连接异构执行体，拟态判决模块与异构执行体互相通信。
数据通信接口有多个，数据通信接口用于拟态调度器和异构执行体或交换芯片通信。拟态判决模块用于实现对多个异构执行体下行数据的判决，根据判决结果选择正确的数据进行发送，避免产生因异构执行体出错导致系统异常，同时根据判决结果和拟态策略确定异构执行体状态是否正常，若异构执行体状态异常需要进行清洗恢复。
本实施例在拟态交换机的拟态调度器内设置数据同步模块，实现不修改STP协议栈代码，也不占用过多内存的情况下，完成异构执行体清洗恢复后的数据同步，节省拟态调度器的存储空间，同步速度快效率高。在异构执行体由于外部攻击或内部错误导致异常后及时恢复正常工作，保证系统稳定性。
以上示意性地对本申请创造及其实施方式进行了描述，该描述没有限制性，在不背离本申请的精神或者基本特征的情况下，能够以其他的具体形式实现本申请。附图中所示的也只是本申请创造的实施方式之一，实际的结构并不局限于此，权利要求中的任何附图标记不应限制所涉及的权利要求。所以，如果本领域的普通技术人员受其启示，在不脱离本创造宗旨的情况下，不经创造性的设计出与该技术方案相似的结构方式及实施例，均应属于本专利的保护范围。此外，“包括”一词不排除其他元件或步骤，在元件前的“一个”一词不排除包括“多个”该元件。产品权利要求中陈述的多个元件也可以由一个元件通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。

Claims (9)

  1. 一种用于交换机的数据同步方法，其特征在于，所述方法包括：
    拟态调度器中的数据同步模块根据收到的STP消息确认同步开始，其中，所述STP消息由待同步异构执行体发送；
    所述数据同步模块收集配置BPDU消息；
    所述数据同步模块根据收集到的配置BPDU消息生成用于同步的配置BPDU消息并发送至待同步异构执行体以便其进行数据同步；以及
    拟态调度器标记同步完成的所述异构执行体。
  2. 根据权利要求1所述的用于交换机的数据同步方法，其特征在于，所述数据同步模块收集配置BPDU消息包括：
    所述数据同步模块收集外部交换机发送的配置BPDU消息；以及
    所述数据同步模块收集收集已经由拟态判决模块判决为可靠的配置BPDU消息。
  3. 根据权利要求2所述的用于交换机的数据同步方法，其特征在于，所述数据同步模块根据收集到的配置BPDU消息生成用于同步的新的配置BPDU消息并发送至待同步异构执行体以便其进行数据同步包括：
    所述数据同步模块基于所述收集的配置BPDU消息，自我训练确定网桥的状态和端口信息，生成用于同步的新的配置BPDU消息并发送至待同步异构执行体；以及
    所述待同步异构执行体基于所接收的新的配置BPDU消息进行STP端口状态和信息同步。
  4. 根据权利要求3所述的用于交换机的数据同步方法，其特征在于，所述数据同步模块基于所述收集的配置BPDU消息，自我训练确定网桥的状态和端口信息，生成用于同步的新的配置BPDU消息并发送至待同步异构执行体包括：
    在本网桥是根桥时，所述数据同步模块向待同步异构执行体发送来自各不同端口的配置BPDU消息，其中，该配置BPDU消息提供的根桥优先级低于本网桥的优先级；
    在本网桥不是根桥时，选举根桥，所述数据同步模块向待同步异构执行体发送模拟根端口的配置BPDU消息，其中，该消息内容与本网桥实际接收到的根桥BPDU消息一致。
  5. 根据权利要求1所述的用于交换机的数据同步方法，其特征在于，所述方法还包括：
    待同步的异构执行体在其清洗恢复后发送所述STP消息至所述拟态调度器，以便所述拟态调度器中的所述数据同步模块根据收到的STP消息确认同步开始。
  6. 根据权利要求5所述的用于交换机的数据同步方法，其特征在于，所述拟态调度器中 的数据同步模块根据收到的STP消息确认同步开始进一步包括：
    所述拟态调度器的拟态判决模块接收将所述STP消息，并在不对所述STP消息进行拟态判决的情况下，将所述STP消息直接转至所述数据同步模块。
  7. 一种数据同步装置，其特征在于，所述数据同步装置包括：
    拟态判决模块，其被配置为接收各异构执行体发送的消息，并判断各异构执行体发送的消息是否可靠；以及
    数据同步模块，其被配置为在确定存在待同步异构执行体时，收集外部交换机发送的配置BPDU消息以及收集已经由拟态判决模块判决为可靠的配置BPDU消息，并以所收集的配置BPDU消息生成用于同步的新的BPDU消息，以及将所生成的新的BPDU消息发出，以便待同步异构执行体同步。
  8. 一种拟态交换机，其特征在于，所述拟态交换机包括如权利要求7所述的数据同步装置。
  9. 一种拟态交换机，其特征在与，所述拟态交换机包括拟态调度器和与其通信连接的多个异构执行体，其中，所述拟态调度器包括数据同步模块和拟态判决模块，所述多个异构执行体完成清洗恢复但尚未同步的异构执行体为待同步异构执行体；所述拟态交换机被配置为执行如权利要求1到6中任意一项所述的用于交换机的数据同步方法。
PCT/CN2020/124399 2020-05-26 2020-10-28 用于交换机的数据同步方法、装置和拟态交换机 WO2021238048A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010452004.9A CN111371907B (zh) 2020-05-26 2020-05-26 一种基于stp协议的数据同步方法、装置和拟态交换机
CN202010452004.9 2020-05-26

Publications (1)

Publication Number Publication Date
WO2021238048A1 true WO2021238048A1 (zh) 2021-12-02

Family

ID=71211112

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/124399 WO2021238048A1 (zh) 2020-05-26 2020-10-28 用于交换机的数据同步方法、装置和拟态交换机

Country Status (2)

Country Link
CN (1) CN111371907B (zh)
WO (1) WO2021238048A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115658983A (zh) * 2022-12-13 2023-01-31 井芯微电子技术(天津)有限公司 一种判决验证的方法及系统
CN115720182A (zh) * 2022-11-18 2023-02-28 国网江苏省电力有限公司信息通信分公司 以太网网关的拟态化改造方法、装置及系统
CN116112286A (zh) * 2023-04-04 2023-05-12 井芯微电子技术(天津)有限公司 一种网络异常检测、恢复方法及装置

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111371907B (zh) * 2020-05-26 2020-08-14 网络通信与安全紫金山实验室 一种基于stp协议的数据同步方法、装置和拟态交换机
CN111752730B (zh) * 2020-08-31 2020-12-04 网络通信与安全紫金山实验室 一种拟态调度判决方法、拟态调度器及可读存储介质
CN112162866B (zh) * 2020-08-31 2023-02-24 中国人民解放军战略支援部队信息工程大学 基于相对时间的异构执行体程序同步方法及装置
CN112152943B (zh) * 2020-09-07 2022-06-14 华东计算技术研究所（中国电子科技集团公司第三十二研究所） 基于拟态交换机处理器控制执行体的方法及系统
CN112104516B (zh) * 2020-11-18 2021-02-12 之江实验室 一种opcua协议支持拟态系统的实现方法
CN112506639A (zh) * 2020-12-31 2021-03-16 河南信大网御科技有限公司 执行体调度清洗方法、调度清洗装置及拟态OpenStack系统
CN112637236B (zh) * 2020-12-31 2022-08-16 河南信大网御科技有限公司 脱离协议栈的http代理方法、架构及介质
CN113285893A (zh) * 2021-02-20 2021-08-20 井芯微电子技术(天津)有限公司 以太网交换机及网络系统
CN113347085B (zh) * 2021-06-02 2022-12-13 河南信大网御科技有限公司 一种拟态环境下实现stp协议的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130250815A1 (en) * 2012-03-22 2013-09-26 Fujitsu Limited Distributed spanning tree protocol
CN110995651A (zh) * 2019-10-31 2020-04-10 浙江工商大学 一种对异构执行体池可靠性进行判决的方法
CN111049677A (zh) * 2019-11-27 2020-04-21 网络通信与安全紫金山实验室 拟态交换机异构执行体的清洗恢复方法和装置
CN111064778A (zh) * 2019-12-09 2020-04-24 盛科网络（苏州）有限公司 基于stp的数据处理方法及系统
CN111371907A (zh) * 2020-05-26 2020-07-03 网络通信与安全紫金山实验室 一种基于stp协议的数据同步方法、装置和拟态交换机

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488879B (zh) * 2008-01-15 2013-09-11 上海贝尔阿尔卡特股份有限公司 以太网生成树协议的网络设备中的故障保护方法及装置
CN107786568B (zh) * 2017-11-03 2020-09-11 中国人民解放军信息工程大学 一种拟态云主机的自动构建装置、方法及系统
CN112313915B (zh) * 2018-11-05 2021-08-31 北京大学深圳研究生院 基于gspn和鞅理论网络空间拟态防御的安全性建模量化方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130250815A1 (en) * 2012-03-22 2013-09-26 Fujitsu Limited Distributed spanning tree protocol
CN110995651A (zh) * 2019-10-31 2020-04-10 浙江工商大学 一种对异构执行体池可靠性进行判决的方法
CN111049677A (zh) * 2019-11-27 2020-04-21 网络通信与安全紫金山实验室 拟态交换机异构执行体的清洗恢复方法和装置
CN111064778A (zh) * 2019-12-09 2020-04-24 盛科网络（苏州）有限公司 基于stp的数据处理方法及系统
CN111371907A (zh) * 2020-05-26 2020-07-03 网络通信与安全紫金山实验室 一种基于stp协议的数据同步方法、装置和拟态交换机

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUO LITIAN;SHAO PEINAN;XU LIDING;XU JUN: "Resource Management and Scheduling Technology for Mimic Common Operating Environment", COMPUTER ENGINEERING, vol. 46, no. 2, 8 November 2019 (2019-11-08), CN, pages 159 - 169, XP055872660, ISSN: 1000-3428, DOI: 10.19678/j.issn.1000-3428.0056123 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115720182A (zh) * 2022-11-18 2023-02-28 国网江苏省电力有限公司信息通信分公司 以太网网关的拟态化改造方法、装置及系统
CN115720182B (zh) * 2022-11-18 2024-07-02 国网江苏省电力有限公司信息通信分公司 以太网网关的拟态化改造方法、装置及系统
CN115658983A (zh) * 2022-12-13 2023-01-31 井芯微电子技术(天津)有限公司 一种判决验证的方法及系统
CN115658983B (zh) * 2022-12-13 2023-05-26 井芯微电子技术(天津)有限公司 一种判决验证的方法及系统
CN116112286A (zh) * 2023-04-04 2023-05-12 井芯微电子技术(天津)有限公司 一种网络异常检测、恢复方法及装置

Also Published As

Publication number Publication date
CN111371907B (zh) 2020-08-14
CN111371907A (zh) 2020-07-03

Similar Documents

Publication Publication Date Title
WO2021238048A1 (zh) 用于交换机的数据同步方法、装置和拟态交换机
Kuźniar et al. Automatic failure recovery for software-defined networks
US8149691B1 (en) Push-based hierarchical state propagation within a multi-chassis network device
JP5369228B2 (ja) ユニキャストトラフィックを復元する方法及び装置
Louca et al. MPI-FT: Portable fault tolerance scheme for MPI
EP1793542B1 (en) Non-stop forwarding in a multi-chassis router
EP2822255B1 (en) System and method of a hardware shadow for a network element
US11863383B2 (en) System and method to debug, optimize, profile, or recover network device in live network
WO2020024615A1 (zh) 一种共识流程恢复方法及相关节点
CN105933253A (zh) 一种sdn网络下交换机配置恢复方法
JP2018170618A (ja) 障害自動復旧システム、制御装置、手順作成装置およびプログラム
CN104170307B (zh) 失效切换方法、装置和系统
CN112506620B (zh) 基于docker容器部署的ospf协议的清洗恢复方法、装置、设备和介质
CN111835555A (zh) 数据恢复方法、装置及可读存储介质
CN111541601B (zh) 动态异构冗余架构的交换设备中stp协议同步的方法及装置
US10205787B2 (en) Method, system, and apparatus for reducing the size of route updates
CN109725916B (zh) 流处理的拓扑结构更新系统和方法
CN110247862B (zh) Sdn集群故障时业务快速连续切换系统及方法
US7808982B2 (en) Method for verifying shared state synchronization of redundant modules in a high availability network switch
KR20170059696A (ko) 네트워크 트래픽 처리 방법, 시스템 및 컴퓨터 판독 가능한 기록 매체
Cisco Cisco IOS System Error Messages Volume 1 of 2 Release 12.2
CN104184803B (zh) 基于dag的自适应完成xia网络中虚拟机在线迁移的方法
Cisco Release Notes for Catalyst 4000 Family Software Release 5.x
CN103927153B (zh) 一种系统配置的方法、设备及系统
Halawa et al. Network fabric redundancy in NCS

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20937502

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20937502

Country of ref document: EP

Kind code of ref document: A1